# Microsoft Defender Suite Reference Microsoft Defender Suite Reference

Produktüberblick, Lizenzmatrix, Integrationen und operative Einsatzmuster für die Microsoft-Defender-Suite.Product overview, licensing matrix, integrations, and operational usage patterns for the Microsoft Defender suite.

Portal Portal

security.microsoft.com als einheitliche Incident-Ansicht.security.microsoft.com as the unified incident view.

Abdeckung Coverage

Endpoints, Identity, Email, SaaS, Cloud und SIEM.Endpoints, identity, email, SaaS, cloud, and SIEM.

Integration Integration

Defender XDR + Sentinel + Entra + Intune.Defender XDR + Sentinel + Entra + Intune.

## Defender XDR Überblick Defender XDR overview

Die Microsoft-Defender-Suite konsolidiert Sicherheitsdaten und Steuerungen rund um Endpunkte, E-Mail, Identitäten, Cloud-Apps und Cloud-Ressourcen. Das operative Zentrum ist das einheitliche Portal unter security.microsoft.com, ergänzt um Defender for Cloud im Azure-Portal und Sentinel für SIEM/SOAR.The Microsoft Defender suite consolidates security data and controls around endpoints, email, identities, cloud apps, and cloud resources. The operational center is the unified portal at security.microsoft.com, complemented by Defender for Cloud in the Azure portal and Sentinel for SIEM and SOAR.

## Defender for Endpoint P1/P2 Defender for Endpoint P1/P2

Capability Capability | P1 P1 | P2 P2
--- | --- | ---
Next-gen protection / AV | Ja | Yes
Attack Surface Reduction | Ja | Yes
EDR | Basis | Advanced
Device inventory | Ja | Yes
Threat & Vulnerability Management | Eingeschränkt | Full
Automated investigation and remediation | Nein | Yes

## Defender for Office 365 P1/P2 Defender for Office 365 P1/P2

Kontrolle Control | Nutzen Purpose
--- | ---
Safe Links Safe Links | URL-Rewrite und Klickschutz für Mail und Collaboration.URL rewrite and click protection for email and collaboration.
Safe Attachments Safe Attachments | Sandboxing für Anhänge und detonationsbasierte Analyse.Sandboxing for attachments and detonation-based analysis.
Anti-phishing Anti-phishing | Spoof-, impersonation- und mailbox-intelligence-basierter Schutz.Spoof, impersonation, and mailbox-intelligence-based protection.
AIR AIR | Automated investigation and remediation für Mail-Events.Automated investigation and remediation for email events.

## Defender for Identity Defender for Identity

Bereich Area | Beschreibung Description
--- | ---
Sensor deployment Sensor deployment | Sensoren auf Domänencontrollern oder per standalone sensor bereitstellen.Deploy sensors on domain controllers or as standalone sensors.
Alerts Alerts | Kerberoasting, DCSync, Pass-the-Ticket, Suspicious LDAP und weitere Indikatoren.Kerberoasting, DCSync, pass-the-ticket, suspicious LDAP, and more indicators.
Lateral movement paths Lateral movement paths | Pfadanalysen für laterale Bewegung und kritische Abhängigkeiten.Path analysis for lateral movement and critical dependencies.

## Defender for Cloud Apps Defender for Cloud Apps

Funktion Function | Beschreibung Description
--- | ---
Discovery Discovery | Shadow-IT erkennen über Firewall-, Proxy- oder Defender-Daten.Discover shadow IT through firewall, proxy, or Defender data.
App governance App governance | OAuth-Apps, Permissions und riskante App-Verhaltensmuster überwachen.Monitor OAuth apps, permissions, and risky app behavior.
Session control Session control | Reverse-Proxy-basierte Echtzeitkontrolle für Downloads, Watermarks und Monitoring.Reverse-proxy-based real-time control for downloads, watermarks, and monitoring.
Policies Policies | Anomaly, activity, file und app-based policies für SaaS und M365.Anomaly, activity, file, and app-based policies for SaaS and M365.

## Defender for Cloud Defender for Cloud

Modul Module | Nutzen Purpose
--- | ---
CSPM CSPM | Secure Score, Empfehlungen und Governance für Cloud-Konfiguration.Secure Score, recommendations, and governance for cloud configuration.
CWP CWP | Workload-Schutz für VMs, SQL, Storage, Containers und mehr.Workload protection for VMs, SQL, storage, containers, and more.
Recommendations Recommendations | Priorisierte Maßnahmen mit regulatorischem Mapping.Prioritized actions with regulatory mapping.

## Microsoft Sentinel Microsoft Sentinel

Baustein Building block | Nutzen Purpose
--- | ---
Data connectors Data connectors | Entra, M365, Defender, Firewalls, EDR und viele Drittquellen anbinden.Connect Entra, M365, Defender, firewalls, EDR, and many third-party sources.
Analytics rules Analytics rules | KQL-basierte Erkennung, Fusion und UEBA.KQL-based detection, fusion, and UEBA.
Playbooks Playbooks | SOAR-Orchestrierung via Logic Apps.SOAR orchestration through Logic Apps.
Workbooks Workbooks | Dashboards für Jagd, Metriken und Management-Berichte.Dashboards for hunting, metrics, and management reporting.

## Integration der Produkte Integration between products

Quelle Source | Integriert mit Integrates with | Mehrwert Value
--- | --- | ---
Defender for Endpoint | Defender XDR, Sentinel, Intune | Gerätealarme, TVM und Device Context in Incident-Ketten.Device alerts, TVM, and device context inside incident chains.
Defender for Office 365 | Defender XDR, Exchange, Sentinel | Mail-Events werden mit Identität und Endpoint-Telemetrie korreliert.Email events are correlated with identity and endpoint telemetry.
Defender for Identity | Defender XDR, Entra ID, Sentinel | On-prem AD-Angriffe werden mit Cloud-Identität verbunden.On-prem AD attacks are connected with cloud identity.
Defender for Cloud Apps | Conditional Access, Defender XDR, Sentinel | Session Control und OAuth-Governance schließen die SaaS-Lücke.Session control and OAuth governance close the SaaS gap.

## Lizenzanforderungen Licensing requirements

Produkt Product | Typische Lizenz Typical license
--- | ---
Defender for Endpoint | Microsoft 365 E5 / Security E5 / Defender for Endpoint P2 Microsoft 365 E5 / Security E5 / Defender for Endpoint P2
Defender for Office 365 | Defender for Office 365 P1/P2 oder M365 E5 Defender for Office 365 P1/P2 or M365 E5
Defender for Identity | M365 E5 / Security E5 / standalone M365 E5 / Security E5 / standalone
Defender for Cloud Apps | M365 E5 / Security E5 / standalone M365 E5 / Security E5 / standalone
Defender for Cloud | Azure-planabhängig, pro Resource und Plan Azure-plan-dependent, per resource and plan
Sentinel | Azure consumption-basiert + Datenvolumen Azure consumption-based plus data volume

## GitHub-Referenzen GitHub references

Repository Repository | Nutzen Purpose
--- | ---
microsoft/Microsoft-365-Defender-Hunting-Queries | KQL- und Hunting-Queries für Defender XDR.KQL and hunting queries for Defender XDR.
Azure/Azure-Sentinel | Analytics Rules, Workbooks, Playbooks und Community Content für Sentinel.Analytics rules, workbooks, playbooks, and community content for Sentinel.

PowerShell

    Connect-MgGraph -Scopes "SecurityEvents.Read.All"
    # Grundlegend: Entra Risk + Defender Incident Korrelationsdaten lesen
    Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/security/incidents"