# Microsoft Defender for Endpoint **Entity class:** Endpoint detection and response platform **Architecture:** [[wiki/Signals, Silos, and Sovereign Software|Signals, Silos, and Sovereign Software]] ## Definition **Microsoft Defender for Endpoint** is an enterprise endpoint-security platform for preventing, detecting, investigating, and responding to advanced threats across workstations, servers, and other managed devices. ## Modern Defense and Cybersecurity Role Endpoint behavioral sensors make machines in a distributed organization part of a continuous defensive telemetry system. The platform supports attack-surface reduction, vulnerability assessment, endpoint detection and response, automated investigation, and containment. ## Chronological Proximity Defender for Endpoint developed from Microsoft's earlier endpoint-protection and advanced-threat-protection products and became a primary sensor inside [[wiki/Microsoft Defender XDR|Defender XDR]]. ## Relational Proximity It streams alerts and activity to [[wiki/Microsoft Sentinel|Sentinel]], shares device evidence with Defender XDR, and uses identity context from [[wiki/Microsoft Entra ID|Microsoft Entra ID]]. ## Collection Routes [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]] · [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]] ## Sources / Provenance - [Primary documentation](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint)