News
New Microsoft Machine Learning Tools Target Alert Fatigue in Defender XDR Platform
Microsoft has begun out new AI-powered incident prioritization capabilities in Microsoft Defender alongside an expanded suite of proactive incident response services, giving security teams more tools to prevent, detect and recover from cybersecurity threats.
The company introduced AI-powered incident prioritization in Microsoft Defender this week, applying machine learning to help security operations center analysts cut through alert fatigue by surfacing the incidents that demand immediate attention. The feature assigns each incident a priority score from 0 to 100 and provides explanations for the ranking.
"Security teams don't struggle because they lack alerts—they struggle because they have too many, arriving faster than humans can triage," wrote Microsoft in a technical community blog post. The company said the new prioritization works across Microsoft native alerts, custom detections and third-party alerts.
The prioritization model considers factors including attack disruption signals, threat analytics context, severity, MITRE ATT&CK techniques, asset criticality and high-profile threats such as ransomware and nation-state activity. Incidents are color-coded for quick identification: red for top priority (scores above 85 percent), orange for medium priority (15 to 85 percent) and gray for low priority (below 15 percent).
Microsoft said the approach is built on BM25, a search-ranking algorithm that balances rare signals, repetition and incident complexity. "Rare signals should matter more than common ones," the company explained in the blog post, noting that the model treats uncommon alert patterns and unusual technique combinations as more informative than routine behaviors.
The incident queue includes a summary pane that displays the priority assessment, influencing factors, key incident details, recommended actions and related threats. Analysts can navigate between incidents directly from the pane without leaving their workflow.
Proactive Response Services Expand
In a separate announcement, Microsoft Incident Response introduced new proactive services designed to strengthen organizational resilience before an incident occurs. Andrew Rapp, general manager of Microsoft Incident Response, said the services build on the team's frontline experience handling real-world cyberattacks.
"As cyberthreats become faster, harder to detect, and more sophisticated, organizations must focus on building resilience -- strengthening their ability to prevent, withstand, and recover from cybersecurity incidents," Rapp wrote in a security blog post. "Resilience can mean the difference between containing an incident with minimal disruption and becoming the next headline."
The new offerings include incident response plan development, which assists organizations in creating their own response plans using lessons from real-world incidents. Microsoft is also offering major event support, providing dedicated teams during critical events such as corporate conferences or sporting events to monitor emerging cyberthreats and prevent incidents in real time.
A new cyber range service delivers simulations that provide hands-on experience in a controlled environment. Security teams engage directly with threat actor tactics using Microsoft security tools to detect, investigate and contain cyberthreats before an actual incident occurs.
The company is also launching advisory services offering one-on-one customized engagements with strategic recommendations, industry-specific consulting and expert guidance informed by current threat actor activity. Additionally, Microsoft is offering compromise assessments during mergers and acquisitions to determine whether organizations being acquired have been previously or are currently compromised.
The expanded services complement Microsoft Incident Response's existing proactive portfolio, which includes compromise assessments, identity assessments, identity hardening and tabletop exercises.
Microsoft said the incident queue's AI-powered prioritization is designed to help organizations act on incidents quickly with confidence. "When prioritization is done well, it's not automation for automation's sake, it's a force multiplier," the company wrote, noting that proper prioritization delivers faster triage, higher analyst confidence and better outcomes as high-impact incidents get attention first.
The new incident queue experience was announced at Microsoft Ignite and is now available in the unified Defender portal. Documentation on the incident queue can be found on Microsoft Learn.