What is our primary use case?
As a working security partner, my main use case for Microsoft Defender Experts for Hunting is that many of our customers also have Microsoft Defender Experts for Hunting and really find a lot of value in getting that extra threat signal that an ordinary security partner wouldn't be able to provide because they're not Microsoft and obviously Microsoft has the largest amount of data to go through and is tracking financially backed threat actors, persistent threats, and nation-state threat actors around the planet.
The fact that they're not only searching for this, but hunting for it within our customers' accounts gives all of us some peace of mind.
What is most valuable?
Proactive threat hunting as well as the Ask an Expert feature, which is a button inside of the XDR portal that becomes available when the customer owns Microsoft Defender Experts for Hunting, are the best features it offers.
If a customer or one of our analysts needs extra support or has a question about a Microsoft Defender Experts for Hunting notification, they can click on that button and chat directly with a Microsoft security analyst to get more information or fill in any gaps regarding the Ask an Expert feature.
Improved detection rates are one of the specific outcomes that show the positive impact because Microsoft Defender Experts for Hunting is a second set of eyes or a second team looking for emerging threats within a shared customer's environment.
For us, the proactive approach that Microsoft Defender Experts for Hunting is always running is valuable, and we see those alerts pop up inside of our incident queues in Microsoft Sentinel and we respond and acknowledge them.
In many cases, Microsoft might see an alert from a zero-day that we aren't even aware of yet or the industry isn't aware of yet and we see that tagged within our incident queue, which allows us to follow up with it much sooner than had we had to search and detect for it ourselves.
Microsoft Defender Experts for Hunting helps my customers detect or prevent emerging threats that are not yet published but Microsoft has visibility into.
Microsoft Defender Experts for Hunting's reporting and analytics are clear and actionable, and the fact that it's tied to the MITRE framework puts it all in a common language.
Microsoft Defender Experts for Hunting helps my customers comply with industry regulations or standards, though I am unsure how, but many have requirements for threat hunting and this checks that box.
Microsoft Defender Experts for Hunting helps my team respond to incidents by providing a backstop, which does speed up the process and improve outcomes.
What needs improvement?
As a partner, Microsoft Defender Experts for Hunting could be improved by getting earlier threat detection signals so we could proactively research on our own end and help support a campaign to raise awareness as well as proactive response.
Having an API or a special threat feed that partners could access would be extremely helpful to make collaboration even smoother regarding the needed improvements.
For how long have I used the solution?
Since its inception in 2023, I have been using Microsoft Defender Experts for Hunting.
What do I think about the stability of the solution?
Microsoft Defender Experts for Hunting is stable.
What do I think about the scalability of the solution?
Microsoft Defender Experts for Hunting's scalability is very scalable. It's one service, one button to turn it on for the entire organization.
How are customer service and support?
The customer support for Microsoft Defender Experts for Hunting was fantastic.
Which solution did I use previously and why did I switch?
I did not previously use a different solution; we just used our own solution.
How was the initial setup?
The learning curve for getting started with Microsoft Defender Experts for Hunting is very easy. It's probably the easiest Microsoft solution to deploy because all you have to do is activate it and the hunters within Microsoft start working immediately.
My experience with pricing, setup cost, and licensing for Microsoft Defender Experts for Hunting is that the pricing is pretty standard, and setup was very easy.
What was our ROI?
I think we've seen a return on investment with Microsoft Defender Experts for Hunting. It's basically peace of mind.
Which other solutions did I evaluate?
Before choosing Microsoft Defender Experts for Hunting, we did not evaluate other options as we are a Microsoft partner.
What other advice do I have?
As a partner, there can be some concern that Microsoft Defender Experts for Hunting is taking away some of our business because they're providing a solution that we also provide. However, the team has been very easy to work with and understandably, we all see benefits from Microsoft sharing that threat intelligence specifically within our customer's environment.
The advice I would give to others looking into using Microsoft Defender Experts for Hunting is that even if you already have a hunting solution, it's not to the same level of Microsoft. Microsoft is likely looking for different things. This is one of those cases where you would want more than one hunting solution.
I gave this product a review rating of ten out of ten.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?