Microsoft announced on 22 October 2026 a new Threat Intelligence experience in Microsoft Defender that puts Overview and Intel explorer at the centre of threat research and investigation. The change is part of the Integrated Security Operations Center release and replaces earlier Threat Intelligence pages, including Threat Analytics and Intel Management, while keeping existing intelligence and Microsoft reports available.
The update is aimed at security operations teams that already work across Microsoft Defender XDR, Microsoft Sentinel and external threat intelligence sources. It changes where analysts start, how they search, and how they move from a report or indicator into an investigation.
Overview as the starting page
Overview is the new starting page for threat intelligence in the Microsoft Defender portal. It shows threats that are relevant to the organisation, including latest threats, high-impact threats and threats with the highest exposure.
The page brings together the external threat landscape with information about the organisation’s own environment. Analysts can focus on industries and regions of interest, review impact and exposure information, and then move into Intel explorer for the supporting intelligence.
Overview also includes threat articles and an executive summary generated by the Threat Intelligence Briefing Agent. Microsoft documentation says email notifications can be configured for updated threat intelligence.
Intel explorer for investigation
Intel explorer provides the investigation workspace. It searches across Microsoft threat research, connected third-party feeds and intelligence curated by the organisation.
Analysts can start with an actor name, a CVE, a domain or an IP address. Keyword search and filters narrow results by threat intelligence type, targeted industry, targeted geography and source.
The supported types include campaigns, indicators, attack patterns, identities, threat actors, tools, vulnerabilities and reports. Threat analytics reports are available directly in Intel explorer.
The investigation path can continue from an indicator into the relevant Defender entity page. Entity pages for IP addresses, domains, URLs and files can show threat intelligence through the Threat Intelligence Insights tab.
For IP addresses and domains, the enrichment can include reputation, attributed threat reports and infrastructure relationships such as DNS, WHOIS, subdomains, certificates, services and related web components. For URLs and files, the enrichment can include reputation, attributed reports and sandbox analysis. Microsoft says all Microsoft Defender XDR customers can access entity enrichments with publicly available Microsoft Threat Intelligence data at no extra cost.
Sentinel and STIX work move into the same area
Intel explorer also covers Microsoft Sentinel threat intelligence work. It can be used to create STIX threat intelligence objects, manage ingestion rules, manage relationships between objects, add tags, edit objects, investigate indicators and export threat intelligence to supported TAXII destinations.
Creating and managing Microsoft Sentinel threat intelligence requires Microsoft Sentinel Contributor or higher permissions. Import and export also require the Threat Intelligence solution in Microsoft Sentinel and the relevant connectors.
Advanced hunting can query Microsoft’s built-in threat intelligence through the ThreatIntelEntities table. That table includes indicators of compromise, threat actors and malicious infrastructure, and can be used to correlate intelligence with activity in the environment.
Migration and access constraints
The legacy standalone Microsoft Threat Intelligence portal and legacy Intel Explorer experience were retired on 1 August 2026. The new experience also changes some names from the previous Threat Analytics model: Technique becomes Attack patterns, Actor becomes Threat actor, Activity becomes Campaign, and OSINT and Core threat become Report. Indicators and identities keep their names.
Relationship information has moved from a separate Relationships tab into the entity details experience. Microsoft says existing threat intelligence capabilities remain unchanged unless the transition documentation describes a specific change.
Access depends on the relevant Microsoft Defender licence. Microsoft also notes that Integrated Security Operations Center customers need an ISOC workspace to use threat intelligence capabilities available in preview. Some documented capabilities are marked as prerelease and may change before commercial release.
Role configuration still matters. Threat analytics access requires security data read permissions, and exposure or recommended action data requires the relevant Vulnerability Management and Exposure Management read permissions.
Turning actor reports, third-party feeds and Sentinel threat intelligence objects into investigation decisions is the kind of security operations work ECS's Security topic covers, alongside Security Copilot, Zero Trust, Sentinel, Purview and DevSecOps. Sessions and workshops give attendees space to compare portal design, role models, hunting practice and practitioner experience from Defender and Sentinel environments. Bring current SOC workflows and migration questions, especially where Threat Analytics, Intel Management or TAXII feeds are already in use.
Photo: Coolcaesar, CC BY-SA 4.0, via Wikimedia Commons, cropped
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.