Complete Guide to Microsoft Defender XDR Using AI Detection (Video)

Master Microsoft Defender XDR with AI driven threat detection that transforms security teams into proactive defenders.

This video course gives learners a complete, practical walkthrough of Microsoft Defender XDR, with a special focus on how AI powered detection is reshaping modern security operations. Youll see how Defender XDR correlates signals across endpoints, identities, email, and cloud apps. Security, cloud and sysadmins can utilize machine learning and automated analysis to uncover threats that traditional tools miss. As organizations face increasingly sophisticated attacks, understanding how to harness AI driven detection isnt just helpful, its essential for staying ahead of adversaries. Learners will understand how to navigate the Defender XDR portal, and automate investigations using AI driven Defender XDR.

Skill Level:

• Intermediate

Learn How To:

• Understand the core architecture and capabilities of Microsoft Defender XDR, including how it unifies signals across endpoints, identities, email, and cloud applications.

• Learn how AIpowered detection works within Defender XDR and how to interpret machinegenerated incidents, alerts, and correlation insights.
• Develop the ability to investigate threats endtoend using the XDR portal, including alert triage, evidence analysis, and incident timelines.
• Gain handson experience with automated investigations, response actions, and orchestration features that streamline SOC operations.
• Configure and operationalize Defender XDR in realworld environments, including policy tuning, integration with Microsoft 365, and bestpractice security settings.
• Strengthen practical security skills by applying Defender XDR workflows to common attack scenarios and modern threat patterns.

Course requirement:

• This course is designed to be accessible, but having some foundational IT or security knowledge will help learners get the most value from the material. A basic understanding of Windows environments, Microsoft 365, and general cybersecurity conceptssuch as threats, alerts, and incident responsewill make the Defender XDR workflows easier to follow. Familiarity with tools like Azure AD, endpoint management, or SIEM/SOAR platforms is helpful but not required.
• Learners dont need to be experts. Any learner who is comfortable navigating IT systems, reading technical dashboards, or working with security tools will be comfortable taking this course. The course walks through each feature stepbystep, making it suitable for beginners entering cybersecurity as well as experienced professionals looking to deepen their expertise with Microsoft Defender XDR.

Who Should Take This Course:

This course is designed for anyone who wants to build real, job ready skills in modern cybersecurity. Whether theyre already in the field or looking to break in. Its especially valuable for IT professionals who are expanding into security, SOC analysts who want to master Microsofts security stack, and cloud or infrastructure engineers who need to understand how Defender XDR ties together signals across an organization.

Its also a strong fit for career changers, students preparing for Microsoft security certifications, and anyone who wants to understand how AI powered detection is transforming threat defense. If youre aiming to work in a security operations center, strengthen your organizations defenses, or simply stay ahead of todays evolving threats, this course gives you the practical skills to do it.

About Pearson Video Training:

Pearson publishes expert-led video tutorials covering a wide selection of technology topics designed to teach you the skills you need to succeed. These professional and personal technology videos feature world-leading author instructors published by your trusted technology brands: Addison-Wesley, Cisco Press, Pearson IT Certification, Prentice Hall, Sams, and Que Topics include: IT Certification, Network Security, Cisco Technology, Programming, Web Development, Mobile Development, and more.  Learn more about Pearson Video training at  http://www.informit.com/video.

Video Lessons are available for download for offline viewing within the streaming format. Look for the green arrow in each lesson.

Table of Contents

Introduction

Lesson 1: Introduction to Microsoft Defender XDR 

1.1 What Defender XDR is and why it matters 

1.2 The evolution of threat detection and AIs role        

1.3 Understanding the unified security operations platform    

1.4 How Microsoft Defender XDR utilizes endpoint detection and response          

Lesson 2: Core Architecture and Components         

2.1 How Defender XDR correlates signals across the Microsoft ecosystem

2.2 Endpoints, identities, email, and cloud app integration     

2.3 Data flow, telemetry, and incident correlation        

2.4 Examine how XDR differs from security and event management using Microsoft Sentinel           

Lesson 3: Navigating the Defender XDR Portal

3.1 Dashboard overview           

3.2 Alerts, incidents, and evidence panels      

3.3 Work with the incident queue like a Security Operations Center (SOC) Analyst 

Lesson 4: Implementing Defender XDR

4.1 Deploy Defender for Identity to protect Active Directory and cloud identities          

4.2 Setup Defender for Office 365 to protect against phishing and malware           

4.3 Onboard Defender for Endpoint to protect client devices  

4.4 Set up protections for cloud applications from online threats        

4.5 Use Defender for Cloud to protect Windows servers          

4.6 Use Defender for Endpoint to protect Linux servers                          

Lesson 5: AIPowered Detection and Analysis          

5.1 How AI and machine learning enhance threat detection   

5.2 Understanding AIgenerated incidents and correlation rules          

5.3 Practical examples of AIdriven threat insights       

5.4 Introduction to the SOC pipeline

5.5 SOC components, including collection, transformation, routing, and enrichment      

Lesson 6: Investigating Threats EndtoEnd

6.1 Alert triage and prioritization           

6.2. Deep dive incident investigation   

6.3 Using timelines, entities, and evidence graphs      

Lesson 7: Automated Investigation and Response

7.1 How automated investigations work           

7.2 Running and reviewing automated actions

7.3 Reducing SOC workload through smart automation           

Lesson 8: Operationalizing Defender XDR

8.1 Policy configuration and best practices     

8.2 Integrating with Microsoft 365 and Entra ID             

8.3 Tuning detection rules and reducing noise

Lesson 9: RealWorld Attack Scenarios

9.1 Common attack patterns and how XDR detects them        

9.2 Handson walkthroughs of network attacks            

9.3 Using AI insights to accelerate response   

Lesson 10: Building a Modern SOC with XDR             

10.1 SOC workflows and role alignment           

10.2 Reporting, metrics, and continuous improvement            

10.3 Simulated incident investigation

Lesson 11: Final Project and Next Steps

11.1 Preparing for Microsoft security certifications

11.2 Operational readiness checklist  

11.3 Career paths and skill development roadmap     

Summary

If you find an error, you can report it to us through our Submit errata page.