defender-tvm

Microsoft Defender TI & Vulnerability Management

This skill covers two complementary capabilities:

• Microsoft Defender Vulnerability Management (MDVM) — risk-based vulnerability management for endpoints (Windows, macOS, Linux, mobile), firmware, browser extensions, certificates, and security baselines.
• Microsoft Defender Threat Intelligence (Defender TI / MDTI) — Microsoft's finished-intel and raw-IOC product for adversary tracking, infrastructure pivoting, and threat hunting enrichment.

Both feed Defender XDR and Sentinel.

When to use

• Prioritizing patching/remediation across a large endpoint estate.
• Measuring exposure score and security baseline drift.
• Hunting and responding to threats with adversary intel and infrastructure data.
• Enriching SIEM alerts with intel profiles and indicator context.

Do not use this skill for endpoint policy/onboarding (defender-for-endpoint), SIEM detection rules (sentinel-detection-engineering), or outside-in attack surface (defender-easm).

MDVM — what's in core MDE Plan 2 vs the add-on

Capability	MDE Plan 2	MDVM Add-on
CVE-based vulnerability inventory	✅	✅
Exposure score, recommendations	✅	✅
Threat-aware prioritization	✅	✅
Security baselines assessment (CIS, STIG)	—	✅
Browser extension inventory	—	✅
Digital certificate inventory	—	✅
Network share configuration assessment	—	✅
Hardware & firmware inventory	—	✅
Block vulnerable applications	—	✅
Authenticated scan for unmanaged Windows	—	✅

Rule of thumb: If you're already on MDE P2 and your audit team asks for CIS-aligned evidence, you need the MDVM add-on.

Approach

MDVM workflow

1. Triage by exposure score, not CVE count. Exposure score weights exploitability + asset criticality + active threat campaigns. A 5,000-CVE backlog sorted by exposure becomes a 50-task action list.

2. Use threat insights filters. Microsoft tags CVEs with: Public Exploit, Verified by Microsoft, Active Threat Campaign, Exploit Available in Kit. Patch Active Threat Campaign first, regardless of CVSS.