Microsoft IT uses Windows Defender Advanced Threat Protection to monitor the network for anomalous behavior that indicates a possible breach. Built-in machine learning and security analytics help us detect, investigate, and respond to targeted attacks.