Who does what
Provider
- Hunt for emerging threats
- Investigate and explain findings
- Provide response recommendations
Your team
- Operate the SOC and act on notifications
- Contain threats and recover systems
- Maintain licenses and cover excluded telemetry
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
- SaaS Applications
Details
Service scope
Best for Defender customers with a SOC that can act on expert findings
Tenant coverage
Hunting is tenant-wide. Eligible products need active licensing and deployment. Third-party detections are excluded.
Server routes
Licensed Defender for Endpoint servers can be covered. Defender for Cloud servers use the separate Hunting - Servers add-on.
Government availability
GCC customers without a FedRAMP requirement can use Hunting for Gov. GCC-H, DoD and sovereign clouds remain excluded.
Full service analysis
Microsoft Defender Experts Hunting searches eligible Defender telemetry for emerging threats, investigates findings and gives your SOC remediation guidance. Your team runs the incident queue, contains threats and recovers systems. The standalone Hunting service is separate from Defender Experts MDR.
- Your team owns
- Operating the incident queue and responding to notifications
- Containing threats, remediating and recovering affected systems
- Maintaining eligible licenses and covering excluded telemetry
Hunting and MDR
Microsoft now calls this service Defender Experts Hunting. Standalone Hunting can supplement another MDR provider through notification APIs. Defender Experts MDR is a separate managed-response offer that includes Hunting. The two subscriptions should not be treated as interchangeable.
Server licensing
The baseline service can cover servers with Defender for Endpoint deployed and its server license. Defender for Cloud coverage follows the Hunting - Servers add-on route. Ask Microsoft to identify each population and billing basis in the order.
Expert assistance
Ask Defender Experts addresses threats and findings, with quarterly credits. It does not include product troubleshooting, custom detection development or emergency incident response. Standalone Hunting also lacks the service delivery manager offered with eligible MDR subscriptions.
Pricing & contract
- Billing
- Per-user, Custom
Request a Microsoft quote for standalone Hunting and eligible server coverage. The service and prerequisite Defender products are separate purchases.
Tradeoffs & buying questions
Strengths
-
Findings appear in existing Defender workflows
Findings reach the existing Defender workflow.
-
Human investigation supplements internal hunting
Human investigation adds context for internal threat hunters.
-
Separate Hunting subscription can support an existing MDR relationship
Standalone Hunting can coexist with another MDR provider.
Considerations
-
Your team executes containment and recovery
The customer must execute containment, remediation and recovery.
-
Coverage stays within eligible Microsoft telemetry
Other vendors’ detections are outside coverage, including data ingested through Sentinel.
-
Standalone Hunting has no service delivery manager
Standalone Hunting does not include a service delivery manager.
Ask before buying
- Which tenant population and server licensing route are included in our quote?
- How will notifications reach our SOC or existing MDR provider, and who is accountable for acting on them?
- Which access permissions, operational-data locations and government-cloud restrictions apply to our tenant?
Integrations
Endpoint
- Microsoft Defender for Endpoint
Other integrations
- Microsoft Defender for Office 365
- Microsoft Defender for Identity
- Microsoft Defender for Cloud Apps
1 more integrations
- Microsoft Entra ID Protection
Common questions
Is Hunting the same as Defender Experts MDR?
No. Standalone Hunting investigates and advises an existing SOC. Defender Experts MDR includes Hunting and adds managed response. Neither the Hunting - XDR SKU name nor a Defender product license establishes that broader service entitlement.
Does every server need the Servers add-on?
No. Servers licensed and deployed through Defender for Endpoint can qualify under the baseline service. Defender for Cloud servers use the Hunting - Servers add-on. Confirm the population and billing route with Microsoft.
Is the service price public?
Request a scoped Microsoft quote separating standalone Hunting, prerequisite Defender products and the Servers add-on where needed. Published Defender product rates do not establish the Hunting service price.
Company details
- Headquarters
- Redmond, Washington
- Founded
- 1975