Product

Microsoft Defender Threat Intelligence

Track documentation and Message Center changes for Microsoft Defender Threat Intelligence.

Microsoft Learn documentation ↗

Latest Microsoft Defender Threat Intelligence changes

Analyst Insights

General

The Analyst insights page was deleted. Its previous notice stated that Defender TI will be discontinued and merged into Microsoft Defender, with existing access available until August 1, 2026.

Data Sets

General

The data sets page was deleted. Its notice stated that Defender TI will be merged into Microsoft Defender and retired on August 1, 2026; existing customers retain access until then.

Gathering Vulnerability Intelligence

General

The tutorial page was deleted. Its notice stated that Defender TI will be discontinued and merged into Microsoft Defender, with existing customers retaining access until August 1, 2026.

Infrastructure Chaining

General

The infrastructure chaining documentation was deleted. It described Defender TI investigation workflows and stated that Defender TI will be merged into Microsoft Defender before retirement on August 1, 2026.

Reputation Scoring

General

The reputation-scoring page was deleted. Its notice says Defender TI will be discontinued and merged into Microsoft Defender; existing customers retain access until August 1, 2026.

Searching And Pivoting

General

The searching and pivoting article was removed. Its notice states that Defender TI will be merged into Microsoft Defender, with existing access continuing until August 1, 2026.

Sorting Filtering And Downloading Data

General

The how-to article covering sorting, filtering, and downloading Defender TI data was deleted. Its notice states that Defender TI will be discontinued and merged into Microsoft Defender, with current access continuing until August 1, 2026.

Using Copilot Threat Intelligence Defender Xdr

General

The documentation page for using Microsoft Security Copilot with Defender Threat Intelligence was deleted, including its requirements, access locations, usage steps, and built-in prompt guidance.

Using Projects

General

The “Using Projects” documentation was removed. It stated that Defender TI will be discontinued and merged into Microsoft Defender, with existing customer access continuing until August 1, 2026.

Using Tags

General

The “Using tags in Microsoft Defender Threat Intelligence” page was deleted. Its content stated that Defender TI will be discontinued and merged into Defender, with existing access continuing until August 1, 2026.

What Is Microsoft Defender Threat Intelligence Defender Ti

Fundamentals

The Defender TI overview documentation was deleted. Its content stated that Defender TI will be discontinued and merged into Microsoft Defender, with existing customers retaining access until August 1, 2026.

Data sets

General

Updated Microsoft Defender documentation in defender/threat-intelligence/data-sets.md.

Searching and pivoting

General

Updated Microsoft Defender documentation in defender/threat-intelligence/searching-and-pivoting.md.