A city SOC wants correlated security incidents that span email, identity, endpoints, and cloud apps instead of siloed alerts. Which Microsoft capability fits that goal?
Select an answer to reveal the explanation.
Short Explanation
Siloed alerts are like four radios that never talk. Defender XDR stitches email, identity, endpoint, and app signals into correlated incidents so analysts see one story. Forms, To Do, and Autopilot solve different municipal problems.
Full Explanation
Microsoft Defender XDR provides extended detection and response by correlating signals across Microsoft Defender workloads such as email, identity, endpoints, and cloud apps. That cross-domain correlation is the fundamentals purpose contrasted with single-product alert silos. Forms, To Do, and Autopilot are not XDR correlation platforms.