Vectra AI CDR for M365

Vectra AI CDR for M365 is a cloud detection and response solution that monitors Microsoft 365 and Azure AD environments for attacker activity. The platform ingests logs from Azure AD, M365, and AWS Control Plane to identify post-compromise behaviors and attacker techniques.

The solution uses AI-based detection models to identify threats across M365 services including SharePoint, OneDrive, Teams, Exchange, Power Automate, and eDiscovery. It maps detected activities to MITRE ATT&CK techniques with coverage exceeding 90% of relevant tactics.

The platform provides entity-based threat prioritization that correlates events across identities, networks, and cloud environments. It reduces alert volume through machine learning models that establish behavioral baselines for the monitored environment.

Investigation capabilities include centralized querying across Azure AD, M365, and AWS Control Plane logs from a single interface. The system includes detection coverage for Copilot for Microsoft 365 to identify abuse of generative AI features.

The solution can be deployed as a standalone platform or paired with managed detection and response services for continuous monitoring. Integration options exist for Microsoft Sentinel and Microsoft Defender for Endpoint to enable automated response workflows.