Microsoft Defender for EDR integration

---
title: Microsoft Defender for EDR integration
description: Integration with the Microsoft Defender for EDR allows Cyber Threat Intelligence \(CTI\) analysts to automatically push malicious or suspicious IP addresses, domains, file hashes, and URLs to Microsoft Defender for continuous monitoring and real-time alerting.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/tisc-ms-defender-integration.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [Microsoft Defender, EDR integration, endpoint detection and response, CTI analyst, malicious IP addresses]
breadcrumb: [TISC Security Tools integrations, TISC Integrations, Integrate, Threat Intelligence Security Center, Security Operations]
---

# Microsoft Defender for EDR integration

Integration with the Microsoft Defender for EDR allows Cyber Threat Intelligence \(CTI\) analysts to automatically push malicious or suspicious IP addresses, domains, file hashes, and URLs to Microsoft Defender for continuous monitoring and real-time alerting.

-   **[Register and configure the Microsoft Defender in the Microsoft Azure portal](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/register-and-configure-the-microsoft-defender-in-the-microsoft-azure-portal.md)**  
Register the Microsoft Defender EDR in the Microsoft Azure portal and grant the read and write access to the application.
-   **[Install and configure Microsoft Defender for EDR Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-ms-defender-configure.md)**  
Install and configure the Microsoft Defender for EDR integration from the ServiceNow Store.
-   **[System properties for Microsoft Defender EDR](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-defender-sys-props.md)**  
The following details the system properties for Microsoft Defender EDR.
-   **[Send observables to EDR](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-ms-defend-edr.md)**  
Send observables to the EDR security tool.

**Parent Topic:**[TISC Security Tools integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-edr-integrations.md)