Microsoft Defender for Endpoint

Endpoint detection and response platform that provides behavioral threat detection, investigation, and response across Windows, macOS, Linux, iOS, and Android devices.

Capabilities

  • Local AI Agent Discovery
    Observe Endpoints

    Automatically discovers local AI agents — including CLI agents, agentic IDEs, desktop AI apps, VS Code extensions, and MCP server configurations — on onboarded Windows and macOS devices, then surfaces them in the Defender portal with a centralized inventory, exposure map showing agent-to-identity-to-resource relationships, and KQL-based advanced hunting. Currently in public preview.

  • Local AI Agent Runtime Protection
    Secure Agents Endpoints

    Inspects the local agent loop on endpoints — user prompts, tool requests before execution, and tool responses — to detect and block prompt injection and high-risk actions by CLI tools, coding assistants, and desktop AI apps.

Scenarios

Solutions