Network Intelligence
See what your devices connect to,
block what they shouldn't
Defender sees every domain your devices connect to. Network Intelligence finds the malicious ones and blocks them everywhere with one rule.
How it works
One rule, from traffic
to takedown
Turn the Defender data you already collect into answers. See which malicious domains your devices connected to and how many connections got through, then act on them through every connector you use.
Response
Block it everywhere,
then take it down
One match, every response. Block the domain across your controls, such as Defender for Endpoint, Cloudflare and Zscaler, and start a Takedown before anyone opens a ticket.
FAQ
Frequently asked questions
Network Intelligence is an Enterprise add-on. The team turns it on with you and connects your Microsoft tenant.
Microsoft Defender for Endpoint with onboarded devices and Advanced Hunting, and admin consent for
ThreatHunting.Read.All. It uses the same Microsoft app as Email Intelligence.No. It reads Defender through read-only Advanced Hunting queries. Blocks in Defender for Endpoint come only from the responses you add to a rule, through their own connection.
Raise an alert, notify Slack, your SIEM or a webhook, and request a Takedown. It can also block the domain in your controls, such as Defender for Endpoint, Cloudflare Zero Trust and Zscaler Internet Access.
No. Counts are per destination, per hour. Hosts and IP addresses are samples of what was reached.
90 days, stored as the number of connections to each destination in each hour.
Abusive infrastructure,
disrupted
Have I Been Squatted helps security teams detect infrastructure targeting their organization, investigate it with evidence, and coordinate takedowns.