Microsoft Defender for Endpoint P2

Microsoft Defender for Endpoint Plan 2 (P2) is Microsoft’s flagship endpoint security platform, used by organisations worldwide to detect, investigate, and respond to advanced threats. It combines all prevention capabilities in P1 with advanced endpoint detection and response (EDR), automated investigation and remediation, threat hunting tools, and access to Microsoft’s security expert team.

What’s Included — Everything in P1, Plus:

• Endpoint Detection & Response (EDR)
  • Continuous recording of all device activity — process creation, network connections, file writes, registry changes, and more — stored for 6 months
  • Advanced attack timeline — when an alert fires, see every step of the attack chain with full context: what ran, what it spawned, what files it wrote, what it connected to
  • Live response — connect to any managed device remotely and run commands, collect forensic artefacts, or execute remediation scripts in real time without disrupting the user
• Automated investigation and remediation (AIR) — Machine learning investigates every alert automatically, determines the scope of the compromise, and remediates confirmed threats (quarantine files, remove registry keys, terminate processes) — reducing mean time to respond from hours to minutes.
• Threat and Vulnerability Management (TVM) — Real-time vulnerability assessment of all enrolled devices with a prioritised remediation queue. Shows which CVEs are being actively exploited in the wild. Tracks software inventory and identifies end-of-life applications.
• Advanced hunting — Query 30 days of raw security telemetry using KQL (Kusto Query Language) to proactively search for indicators of compromise, investigate past incidents, and build custom detections.
• Custom detections — Write detection rules that run continuously against incoming telemetry. Get alerted immediately when specific behaviours occur — even if they don’t trigger built-in alerts.
• Microsoft Threat Experts — On-demand access to Microsoft’s security analysts. Ask Experts on Demand questions about specific incidents, or opt into Targeted Attack Notifications where Microsoft proactively notifies you when they observe active threats targeting your organisation.
• Threat intelligence — Built-in threat analytics with reports on active threat actors and campaigns targeting your industry, with direct mapping to which of your devices are at risk.

Ideal For

Enterprises, organisations in regulated industries, managed security service providers (MSSPs), and any business that has experienced a serious security incident and needs the tools to detect and respond to advanced threats. If you want to know not just that malware was blocked but exactly what it did and whether it spread, P2 is the right plan.