Skip to content
← Back to the guide

Defender Attack Disruption

7slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M
solvingmicrosoft365.com
1 / 7

Defender Attack Disruption

Automatic Attack Disruption is Defender XDR's ability to contain in-progress attacks automatically — what it does and how.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-attack-disruption

Slide 1Download PNG
M
solvingmicrosoft365.com
2 / 7
01

What Attack Disruption does

When Defender XDR's correlation engine determines with high confidence that a specific attack pattern is happening — based on signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defen…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-attack-disruption

Slide 2Download PNG
M
solvingmicrosoft365.com
3 / 7
02

What attacks are covered

Microsoft has progressively added attack patterns to disruption coverage:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-attack-disruption

Slide 3Download PNG
M
solvingmicrosoft365.com
4 / 7
03

High-confidence is the bar

Attack Disruption only fires when Microsoft's confidence is very high — false positives in automated containment would be operationally devastating. The detection patterns combine:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-attack-disruption

Slide 4Download PNG
M
solvingmicrosoft365.com
5 / 7
04

How analysts interact

When disruption fires, the SOC sees:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-attack-disruption

Slide 5Download PNG
M
solvingmicrosoft365.com
6 / 7
05

Prerequisites

Attack Disruption requires:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-attack-disruption

Slide 6Download PNG
M
solvingmicrosoft365.com
7 / 7
06

When it matters

Attack Disruption matters most for organisations with:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-attack-disruption

Slide 7Download PNG

Auto-generated from Defender Attack Disruption. This page is not indexed and isn't part of the guide itself.