Microsoft Defender for Identity
E325215
Microsoft Defender for Identity is a cloud-based security solution that uses on-premises Active Directory signals to detect, investigate, and respond to advanced identity-based threats in enterprise environments.
All labels observed (5)
How this entity was disambiguated
This entity first appeared as the object of triple T3058533 — resolving that mention is where its identity was fixed. The disambiguator weighed these candidate entities and picked the highlighted one (or “None”, minting a new entity). This is how homonymy is resolved: the same surface form can point to different entities.
NED1
Entity disambiguation (via context triple)
gpt-5-mini-2025-08-07
Target entity: Microsoft Defender for Identity Context triple: [Microsoft 365 E5, includes, Microsoft Defender for Identity]
-
A.
Microsoft 365 Defender
Microsoft 365 Defender is Microsoft’s unified, cloud-based security suite that coordinates protection, detection, and response across endpoints, email, identities, and applications in the Microsoft 365 ecosystem.
-
B.
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is an enterprise-grade endpoint security platform from Microsoft that provides advanced threat protection, detection, and response capabilities across organizational devices and networks.
-
C.
Microsoft Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email and collaboration security solution that protects Microsoft 365 users from phishing, malware, and other advanced threats.
-
D.
Privileged Identity Management
Privileged Identity Management is a Microsoft security service that provides just-in-time, approval-based, and time-limited access to sensitive roles and resources to reduce the risks associated with standing administrative privileges.
-
E.
Microsoft Entra
Microsoft Entra is Microsoft’s unified identity and access management product family that secures access to applications, resources, and digital identities across cloud and hybrid environments.
- F. None of above. chosen
- G. Unsure - the case is ambiguous/there is not enough information to decide.
NED2
Entity disambiguation (via description)
gpt-5-mini-2025-08-07
Target entity: Microsoft Defender for Identity Target entity description: Microsoft Defender for Identity is a cloud-based security solution that uses on-premises Active Directory signals to detect, investigate, and respond to advanced identity-based threats in enterprise environments.
-
A.
Microsoft 365 Defender
Microsoft 365 Defender is Microsoft’s unified, cloud-based security suite that coordinates protection, detection, and response across endpoints, email, identities, and applications in the Microsoft 365 ecosystem.
-
B.
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is an enterprise-grade endpoint security platform from Microsoft that provides advanced threat protection, detection, and response capabilities across organizational devices and networks.
-
C.
Microsoft Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email and collaboration security solution that protects Microsoft 365 users from phishing, malware, and other advanced threats.
-
D.
Privileged Identity Management
Privileged Identity Management is a Microsoft security service that provides just-in-time, approval-based, and time-limited access to sensitive roles and resources to reduce the risks associated with standing administrative privileges.
-
E.
Microsoft Entra
Microsoft Entra is Microsoft’s unified identity and access management product family that secures access to applications, resources, and digital identities across cloud and hybrid environments.
- F. None of above. chosen
Statements (53)
| Predicate | Object |
|---|---|
| instanceOf |
Microsoft security product
ⓘ
cloud-based security solution ⓘ identity threat protection product ⓘ |
| deploymentModel | hybrid ⓘ |
| detects |
advanced identity-based threats
ⓘ
brute-force attacks ⓘ compromised credentials ⓘ domain dominance activities ⓘ kerberoasting attacks ⓘ lateral movement ⓘ malicious insider activities ⓘ pass-the-hash attacks ⓘ pass-the-ticket attacks ⓘ privilege escalation attempts ⓘ reconnaissance activities ⓘ suspicious user activities ⓘ |
| developer | Microsoft ⓘ |
| formerlyKnownAs |
Azure Advanced Threat Protection
ⓘ
linked to:
Microsoft Defender for Identity
|
| integratesWith |
Azure AD Identity Protection
ⓘ
linked to:
Azure Active Directory
Microsoft 365 Defender portal ⓘ
linked to:
Microsoft 365 Defender
Microsoft Defender for Cloud Apps ⓘ Microsoft Defender for Endpoint ⓘ Microsoft Sentinel ⓘ |
| monitors |
authentication patterns
ⓘ
entity behavior ⓘ lateral movement paths ⓘ on-premises Active Directory environments ⓘ user activities ⓘ |
| partOf |
Microsoft 365 Defender
ⓘ
Microsoft Defender ⓘ |
| provides |
attack timeline views
ⓘ
entity profiles ⓘ lateral movement path analysis ⓘ security alerts ⓘ security recommendations ⓘ |
| requires |
Active Directory domain controller access
ⓘ
sensors on domain controllers ⓘ |
| runsOn | cloud ⓘ |
| securityDomain |
identity security
ⓘ
incident response ⓘ threat detection ⓘ threat investigation ⓘ |
| supports |
automated response
ⓘ
incident investigation ⓘ threat hunting ⓘ |
| targetUser |
enterprise organizations
ⓘ
security operations teams ⓘ |
| uses |
Windows event logs
ⓘ
behavioral analytics ⓘ machine learning ⓘ network traffic data ⓘ on-premises Active Directory signals ⓘ security alerts ⓘ |
How these facts were elicited
The pipeline generated the facts above by prompting gpt-5.1 with this entity's name + description and the instruction below.
Instruction
You are a knowledge base construction expert. Given a subject entity and a description of it, return factual statements that you know for the subject as a JSON list of dictionaries(triples), where keys must be "subject", "predicate" and "object". The number of facts may be very high, between 25 to 50 or more, for very popular subjects. For less popular subjects, the number of facts can be very low, like 5 or 10. # Requirements - If you don't know the subject at all, return an empty list. - If the subject is not a named entity, return an empty list. - Include at least one triple where predicate is "instanceOf". - Do not get too wordy. - Separate several objects into multiple triples with one object.
Input
Subject: Microsoft Defender for Identity Description of subject: Microsoft Defender for Identity is a cloud-based security solution that uses on-premises Active Directory signals to detect, investigate, and respond to advanced identity-based threats in enterprise environments.
Referenced by (10)
Full triples — surface form annotated when it differs from this entity's canonical label.
linked to: Microsoft Defender for Identity
Microsoft Security portfolio
→
includesProduct
→
Microsoft Defender for Identity (formerly Azure Advanced Threat Protection)
ⓘ
linked to: Microsoft Defender for Identity
linked to: Microsoft Defender for Identity
linked to: Microsoft Defender for Identity