Proactive threat hunting as well as the Ask an Expert feature, which is a button inside of the XDR portal that becomes available when the customer owns Microsoft Defender Experts for Hunting, are the best features it offers. If a customer or one of our analysts needs extra support or has a question about a Microsoft Defender Experts for Hunting notification, they can click on that button and chat directly with a Microsoft security analyst to get more information or fill in any gaps regarding the Ask an Expert feature. Improved detection rates are one of the specific outcomes that show the positive impact because Microsoft Defender Experts for Hunting is a second set of eyes or a second team looking for emerging threats within a shared customer's environment. For us, the proactive approach that Microsoft Defender Experts for Hunting is always running is valuable, and we see those alerts pop up inside of our incident queues in Microsoft Sentinel and we respond and acknowledge them. In many cases, Microsoft might see an alert from a zero-day that we aren't even aware of yet or the industry isn't aware of yet and we see that tagged within our incident queue, which allows us to follow up with it much sooner than had we had to search and detect for it ourselves. Microsoft Defender Experts for Hunting helps my customers detect or prevent emerging threats that are not yet published but Microsoft has visibility into. Microsoft Defender Experts for Hunting's reporting and analytics are clear and actionable, and the fact that it's tied to the MITRE framework puts it all in a common language. Microsoft Defender Experts for Hunting helps my customers comply with industry regulations or standards, though I am unsure how, but many have requirements for threat hunting and this checks that box. Microsoft Defender Experts for Hunting helps my team respond to incidents by providing a backstop, which does speed up the process and improve outcomes.
