# Microsoft Threat Intelligence Center **Entity class:** Cyber threat-intelligence organization **Architecture:** [[wiki/Signals, Silos, and Sovereign Software|Signals, Silos, and Sovereign Software]] ## Definition The **Microsoft Threat Intelligence Center (MSTIC)** is Microsoft's threat-intelligence organization for tracking nation-state and other sophisticated adversaries and translating observations across Microsoft's global telemetry into actor assessments, detections, and defensive guidance. ## Modern Defense and Cybersecurity Role MSTIC demonstrates how a commercial platform operator has become a strategic intelligence collector. Its visibility across identity, endpoint, cloud, email, and service infrastructure can expose campaigns that no single customer could see alone. ## Chronological Proximity MSTIC expanded with Microsoft's cloud and security portfolio and became a central source of adversary context for Defender products and public reporting. ## Relational Proximity MSTIC analysts work with Microsoft security engineering teams; [[wiki/Microsoft Defender XDR|Defender XDR]] and [[wiki/Microsoft Sentinel|Sentinel]] operationalize detections, while the [[wiki/Microsoft Digital Crimes Unit|Digital Crimes Unit]] can add legal and disruption pathways. ## Collection Routes [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]] · [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]] ## Sources / Provenance - [Primary documentation](https://www.microsoft.com/en-us/security/security-insider/intelligence-reports)