{"id":90583,"date":"2020-02-20T06:00:09","date_gmt":"2020-02-20T14:00:09","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=90583"},"modified":"2023-09-26T08:53:17","modified_gmt":"2023-09-26T15:53:17","slug":"microsoft-threat-protection-intelligence-automation","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/","title":{"rendered":"Microsoft Threat Protection stops attack sprawl and auto-heals enterprise assets with built-in intelligence and automation"},"content":{"rendered":"<p>Attackers will cross multiple domains like email, identity, endpoints, and applications to find the point of least resistance. Today\u2019s defense solutions have been designed to protect, detect, and block threats for each domain separately, allowing attackers to exploit the seams and threshold differences between solutions\u2014leaving the business vulnerable to attack. While one facet of an attack may be caught and blocked in email, the same threat actor may have also compromised identities by exploiting weak passwords or leaked credentials, or by fooling people into providing their passwords or authorization tokens. It\u2019s also possible for point solutions to overlook critical signals entirely because, in isolation, they failed to register as significant.<\/p>\n<p>The industry as a whole has struggled to win this battle, but we can turn the tide. The current class of security solutions can do a better job of stopping or even preventing the spread of attacks by looking at the entire security stack as a living organism. We have to force a shift in the protection paradigm by moving from a model of reactive detection and response based on siloed security solutions to proactive protection. We cannot leave security teams to manually coordinate signals across domains to fully understand the breadth of the attack and how to stop it. Threat protection that changes our approach to attacks requires built-in intelligence that can understand how an attack got in, prevent its spread across domains, and automatically heal compromised assets.<\/p>\n<h3>Microsoft Threat Protection coordinates defenses to stop attacks from spreading and auto-heal impacted assets<\/h3>\n<p>Generally available <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/business\/threat-protection\/integrated-threat-protection\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Threat Protection (MTP)<\/a> provides the built-in intelligence, automation, and integration to coordinate protection, detection, response, and prevention by combining and orchestrating into a single solution the capabilities of Microsoft Defender Advanced Threat Protection (ATP) (endpoints), Office 365 ATP (email), Azure ATP (identity), and Microsoft Cloud App Security (apps).<\/p>\n<p>With MTP, security teams can:<\/p>\n<ul>\n<li><strong>Automatically block attacks and eliminate their persistence to keep them from starting again.<\/strong> MTP looks across domains to understand the entire chain of events, identify affected assets, and protect your most sensitive resources. When, for example, a compromised user or an at-risk device tries to access confidential information, MTP applies conditional access and blocks the attack, delivering on the <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/business\/zero-trust\" target=\"_blank\" rel=\"noopener noreferrer\">Zero Trust model<\/a>.<\/li>\n<li><strong>Prioritize incidents for investigation and response.<\/strong> MTP lets you focus on what matters the most by correlating alerts and low-level signals into incidents to determine the full scope of the threat across <a href=\"https:\/\/www.microsoft.com\/microsoft-365\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft 365 services<\/a>. Incidents provide a complete picture of the threat in real time and in a single, cohesive console.<\/li>\n<li><strong>Auto-heal assets. <\/strong>MTP identifies affected assets like users, endpoints, mailboxes, and applications, and returns them to a safe state. Automated healing includes actions like identifying and terminating malicious processes on endpoints and removing mail forwarding rules attackers put in place and marking users as compromised in the directory.<\/li>\n<li><strong>Focus unique expertise on cross-domain hunting. <\/strong>MTP empowers the security team to be proactive, giving them back the time they need to learn from our insights, harden defenses, and keep out more threats. It also lets them use their unique organizational knowledge like proprietary indicators of compromise, org-specific behavioral patterns,\u00a0and\u00a0free-form research\u00a0to actively hunt for threats across domains with custom queries over raw data.<\/li>\n<\/ul>\n<p>Microsoft\u2019s protection, detection, and response solutions have consistently achieved leadership placement, including in <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/08\/23\/gartner-names-microsoft-a-leader-in-2019-endpoint-protection-platforms-magic-quadrant\/\" target=\"_blank\" rel=\"noopener noreferrer\">Gartner\u2019s Endpoint Protection Platform Magic Quadrant<\/a>, <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/10\/29\/gartner-microsoft-leader-2019-cloud-access-security-broker-casb-magic-quadrant\/\" target=\"_blank\" rel=\"noopener noreferrer\">Gartner\u2019s Cloud Access Security Broker (CASB) Magic Quadrant<\/a> and <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/10\/01\/forrester-names-microsoft-a-leader-in-2019-endpoint-security-suites-wave\/\" target=\"_blank\" rel=\"noopener noreferrer\">Forrester\u2019s Endpoint Security Suites Wave<\/a>. Our world-class security research teams study attacker behaviors within each of these solution domains and, more importantly, how attackers traverse these domains in pursuit of their ultimate objective.<\/p>\n<p>Not only have we embraced the MITRE ATT&amp;CK framework for endpoints, we joined the <a href=\"https:\/\/mitre-engenuity.org\/mitre-engenuity-announces-the-center-for-threat-informed-defense\/\" target=\"_blank\" rel=\"noopener noreferrer\">MITRE Center for Threat Informed Defense<\/a> as a Founding Research Sponsor to share and grow our understanding of the full scope of cross-domain attacker behaviors. The deep knowledge we have about each of these pillars of protection, combined with the <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/11\/04\/further-enhancing-security-microsoft\/\" target=\"_blank\" rel=\"noopener noreferrer\">more than 100 members<\/a> in the <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/business\/intelligent-security-association\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Intelligent Security Association (MISA)<\/a>, provides our customers with the holistic protection prevention they need to finally get ahead of attacks.<\/p>\n<h3>Coordinated defenses to uncover the full attack kill chain can help block nation-state level attacks<\/h3>\n<p>Cloud services significantly expand the traditional perimeter that defenders have to monitor and protect, introducing novel attack scenarios. HOLMIUM, a well-known adversary focused on victims mostly in the energy and aerospace sectors where the payouts are massive, has been one of the first to use cloud attack vectors.<\/p>\n<p>In 2019, the <a href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2019\/07\/17\/new-cyberthreats-require-new-ways-to-protect-democracy\/\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Threat Intelligence Center notified<\/a> nearly 10,000 customers targeted by a few nation-state actors, citing HOLMIUM as one of the most active. Sophisticated attacks like this are why MTP was created. A recent HOLMIUM attack pattern demonstrates this: HOLMIUM targets identities in the cloud as a first step. After compromising an identity, the adversary leverages cloud APIs to persist, using a cloud email configuration to run malicious PowerShell on the endpoint every time Outlook is opened by the user. A conventional approach to containing this threat may start with the endpoint; when the PowerShell activity is detected, the SOC remediates the endpoint. However, in this case the attacker is persistent in the cloud and so the endpoint could be immediately compromised again.<\/p>\n<p>MTP looks at the bigger picture and goes beyond simple blocking on the endpoint, putting a compromised organization in a better position to fight the threat. Signs of the attack are detected across the affected domains, including password spraying activity against <a href=\"https:\/\/azure.microsoft.com\/en-us\/services\/active-directory\/\" target=\"_blank\" rel=\"noopener noreferrer\">Azure Active Directory (AD)<\/a>, sign-ins to Office 365 with potentially compromised credentials, and malicious PowerShell executions on endpoints. These detections are correlated into a coherent incident that catalogs the end-to-end attack and all affected assets. MTP intervenes to block the attack, not only stopping the PowerShell activity on the endpoints but also containing the impacted user accounts by marking them as compromised in Azure AD. The Threat Analytics report in MTP provides an exposure view and recommends the customer apply the appropriate Outlook security patch that will prevent this attack from recurring.<\/p>\n<h3>MTP extends coordinated protection across platforms with Microsoft Defender ATP for Linux and across domains with Azure Sentinel<\/h3>\n<p>Today, we\u2019re announcing another step in our journey to offer security from Microsoft with the public preview of Microsoft Defender ATP for Linux. Extending endpoint threat protection to Linux has been a long-time ask from our customers and we\u2019re excited to be able to deliver on that. We know our customers\u2019 environments are complex and heterogenous. Providing comprehensive protection across multiple platforms through a single solution and streamlined view is more important than ever. Next week at the RSA Conference, we\u2019ll provide a preview of our investments in mobile threat defense with the work we\u2019re doing to bring our solutions to Android and iOS.<\/p>\n<p><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/free-import-of-aws-cloudtrail-logs-through-june-2020-and-other-exciting-azure-sentinel-updates\/\" target=\"_blank\" rel=\"noopener noreferrer\">Azure Sentinel<\/a>, Microsoft\u2019s cloud-native security information and event manager (SIEM), further extends the capabilities of MTP by incorporating alerts, threat intelligence, and signals from third-party solutions. MTP shares alerts and threat intelligence with Azure Sentinel so security teams can view and manage threats across Microsoft and third-party security solutions in a single SIEM console.<\/p>\n<p>\n<div class=\"wp-block-group is-layout-constrained wp-block-group-is-layout-constrained\"><div class=\"wp-block-msxcm-cta-block\" data-moray data-bi-an=\"CTA Block\">\n\t<div class=\"card d-block mx-ng mx-md-0\">\n\t\t<div class=\"row no-gutters\">\n\n\t\t\t\t\t\t\t<div class=\"col-md-4\">\n\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"150\" height=\"150\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/10\/Azure-Sentinal.png\" class=\"card-img img-object-cover\" alt=\"\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/10\/Azure-Sentinal.png 150w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/10\/Azure-Sentinal-100x100.png 100w\" sizes=\"(max-width: 150px) 100vw, 150px\" \/>\t\t\t\t<\/div>\n\t\t\t\n\t\t\t<div class=\"d-flex col-md\">\n\t\t\t\t<div class=\"card-body align-self-center p-4 p-md-5\">\n\t\t\t\t\t<h2>Azure Sentinel<\/h2>\n\n\t\t\t\t\t<div class=\"mb-3\">\n\t\t\t\t\t\t<p>Intelligent security analytics for your entire enterprise.<\/p>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\t\t\t\t\t\t<div class=\"link-group\">\n\t\t\t\t\t\t\t<a href=\"https:\/\/azure.microsoft.com\/en-us\/services\/azure-sentinel\/\" class=\"btn btn-link text-decoration-none p-0\" target=\"_blank\">\n\t\t\t\t\t\t\t\t<span>Learn more<\/span>\n\t\t\t\t\t\t\t\t<span class=\"glyph-append glyph-append-chevron-right glyph-append-xsmall\"><\/span>\n\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t<\/div>\n<\/div>\n<\/div>\n<\/p>\n<p>To learn more about how Microsoft Threat Protection can help you deliver proactive protection and prevention against the spread of attacks, see <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/business\/threat-protection\/integrated-threat-protection?rtc=1\">Microsoft Threat Protection<\/a> and stop by our booth at the RSA Conference!<\/p>\n<p>Stay tuned for more information on our cross-platform journey from our Tech Community blogs next week!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Threat protection that changes our approach to attacks requires built-in intelligence that can understand how an attack got in, prevent its spread across domains, and automatically heal compromised assets.<\/p>\n","protected":false},"author":96,"featured_media":90659,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3662],"topic":[3664,3665,3685],"products":[3690,3691,3702,3703,3726],"threat-intelligence":[],"tags":[3769,3788],"coauthors":[1916],"class_list":["post-90583","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-news","topic-ai-and-machine-learning","topic-analyst-reports","topic-siem-and-xdr","products-microsoft-defender","products-microsoft-defender-for-cloud","products-microsoft-entra","products-microsoft-entra-id","products-microsoft-sentinel","tag-gartner-magic-quadrant","tag-mitre-attck"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Microsoft Threat Protection stops attack sprawl and auto-heals enterprise assets with built-in intelligence and automation | Microsoft Security Blog<\/title>\n<meta name=\"description\" content=\"Threat protection that changes our approach to attacks requires built-in intelligence that can understand how an attack got in, prevent its spread across domains, and automatically heal compromised assets.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Microsoft Threat Protection stops attack sprawl and auto-heals enterprise assets with built-in intelligence and automation | Microsoft Security Blog\" \/>\n<meta property=\"og:description\" content=\"Threat protection that changes our approach to attacks requires built-in intelligence that can understand how an attack got in, prevent its spread across domains, and automatically heal compromised assets.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2020-02-20T14:00:09+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-09-26T15:53:17+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/02\/Microsoft-Threat-Protection-stops-attack-sprawl-FB.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Microsoft Security Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/02\/Microsoft-Threat-Protection-stops-attack-sprawl-Twitter.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Microsoft Security Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/microsoft-secure-blog-staff\/\",\"@type\":\"Person\",\"@name\":\"Microsoft Security Team\"}],\"headline\":\"Microsoft Threat Protection stops attack sprawl and auto-heals enterprise assets with built-in intelligence and automation\",\"datePublished\":\"2020-02-20T14:00:09+00:00\",\"dateModified\":\"2023-09-26T15:53:17+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/\"},\"wordCount\":1249,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/02\/Microsoft-Threat-Protection-stops-attack-sprawl-BANNER-UPDATED.png\",\"keywords\":[\"Gartner Magic Quadrant\",\"MITRE ATT&amp;CK\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/\",\"name\":\"Microsoft Threat Protection stops attack sprawl and auto-heals enterprise assets with built-in intelligence and automation | Microsoft Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/02\/Microsoft-Threat-Protection-stops-attack-sprawl-BANNER-UPDATED.png\",\"datePublished\":\"2020-02-20T14:00:09+00:00\",\"dateModified\":\"2023-09-26T15:53:17+00:00\",\"description\":\"Threat protection that changes our approach to attacks requires built-in intelligence that can understand how an attack got in, prevent its spread across domains, and automatically heal compromised assets.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/02\/Microsoft-Threat-Protection-stops-attack-sprawl-BANNER-UPDATED.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/02\/Microsoft-Threat-Protection-stops-attack-sprawl-BANNER-UPDATED.png\",\"width\":1200,\"height\":600,\"caption\":\"Person looking at a laptop\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Microsoft Threat Protection stops attack sprawl and auto-heals enterprise assets with built-in intelligence and automation\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Microsoft Threat Protection stops attack sprawl and auto-heals enterprise assets with built-in intelligence and automation | Microsoft Security Blog","description":"Threat protection that changes our approach to attacks requires built-in intelligence that can understand how an attack got in, prevent its spread across domains, and automatically heal compromised assets.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/","og_locale":"en_US","og_type":"article","og_title":"Microsoft Threat Protection stops attack sprawl and auto-heals enterprise assets with built-in intelligence and automation | Microsoft Security Blog","og_description":"Threat protection that changes our approach to attacks requires built-in intelligence that can understand how an attack got in, prevent its spread across domains, and automatically heal compromised assets.","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/","og_site_name":"Microsoft Security Blog","article_published_time":"2020-02-20T14:00:09+00:00","article_modified_time":"2023-09-26T15:53:17+00:00","og_image":[{"width":1200,"height":600,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/02\/Microsoft-Threat-Protection-stops-attack-sprawl-FB.jpg","type":"image\/jpeg"}],"author":"Microsoft Security Team","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/02\/Microsoft-Threat-Protection-stops-attack-sprawl-Twitter.jpg","twitter_misc":{"Written by":"Microsoft Security Team","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/microsoft-secure-blog-staff\/","@type":"Person","@name":"Microsoft Security Team"}],"headline":"Microsoft Threat Protection stops attack sprawl and auto-heals enterprise assets with built-in intelligence and automation","datePublished":"2020-02-20T14:00:09+00:00","dateModified":"2023-09-26T15:53:17+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/"},"wordCount":1249,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/02\/Microsoft-Threat-Protection-stops-attack-sprawl-BANNER-UPDATED.png","keywords":["Gartner Magic Quadrant","MITRE ATT&amp;CK"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/","name":"Microsoft Threat Protection stops attack sprawl and auto-heals enterprise assets with built-in intelligence and automation | Microsoft Security Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/02\/Microsoft-Threat-Protection-stops-attack-sprawl-BANNER-UPDATED.png","datePublished":"2020-02-20T14:00:09+00:00","dateModified":"2023-09-26T15:53:17+00:00","description":"Threat protection that changes our approach to attacks requires built-in intelligence that can understand how an attack got in, prevent its spread across domains, and automatically heal compromised assets.","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/02\/Microsoft-Threat-Protection-stops-attack-sprawl-BANNER-UPDATED.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/02\/Microsoft-Threat-Protection-stops-attack-sprawl-BANNER-UPDATED.png","width":1200,"height":600,"caption":"Person looking at a laptop"},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/20\/microsoft-threat-protection-intelligence-automation\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"Microsoft Threat Protection stops attack sprawl and auto-heals enterprise assets with built-in intelligence and automation"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"msxcm_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/90583"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=90583"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/90583\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media\/90659"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=90583"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=90583"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=90583"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=90583"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=90583"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=90583"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=90583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}