Windows Defender Advanced Threat Protection is a new service that helps our enterprise customers to detect, investigate, and respond to advanced and targeted attacks on their networks.
Windows Defender ATP is composed of three parts:
- The Client – end-point behavioral sensor, built into Windows 10 (Windows 10 Anniversary update, Windows Insider Preview Build number 14332 and later) and activated upon service enrollment. The client logs relevant security events and behaviors from the endpoint.
- Cloud security analytics service – processing data from endpoints in combination with historical data and Microsoft’s wide data repository to detect anomalous behaviors, adversary techniques and similarity to known attacks. The service runs on the Microsoft scalable big data platform, and uses a combination of Indicators of Attacks (IOAs), generic analytics and machine learning rules, as well as Indicators of Compromises (IOCs) collected from past attacks.
- Microsoft and community intelligence – our Hunters and researchers investigate the data, finding new behavioral patterns and correlating the data with existing knowledge from the security community.
To sign up for the preview of Windows Defender: Advanced Threat Protection, visit the following site:
- BETA: Windows Defender Advanced Threat Protection Preview