Microsoft Defender XDR will allow alert tuning rules to target specific detection sources for finer control. This feature rolls out in public preview mid-October 2026 and general availability mid-November 2026. Existing rules apply to all sources unless updated. No action is needed unless customization is desired.
Day in brief
Defender for Endpoint distinguishes cloned Linux VMs and avoids SSE4.1 crashes
The period contained one Endpoint update: cloned Linux virtual machines are now correctly identified as unique Defender for Endpoint devices, while SIGILL crashes on processors without SSE4.1 support were fixed. The update also includes general reliability improvements.
- Linux device identity and stability fixes
Endpoint · Endpoint protectionCloned Linux virtual machines are now correctly identified as unique Defender for Endpoint devices. SIGILL crashes on processors without SSE4.1 support were fixed, along with general reliability improvements.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
2 updates
Microsoft Defender XDR
1 updateMicrosoft Defender for Endpoint
1 updateMicrosoft Defender Endpoint Releases
Feature updateCloned Linux virtual machines are now correctly identified as unique Defender for Endpoint devices. SIGILL crashes on processors without SSE4.1 support were fixed, along with general reliability improvements.