# defender process

**Defender process** usually refers to **EDR Process Correlation**—Vectra’s feature that stitches **Microsoft Defender for Endpoint (MDE) process context** into **Vectra NDR detections**.

## What it does

When Vectra detects suspicious network behavior, it automatically:

* Queries MDE telemetry for the affected host
* Analyzes process activity in the detection window (via MDE Advanced Hunting)
* Identifies the most probable process responsible
* Shows complete process context **inside the Vectra detection** (no manual timeline correlation)

This is described in [Microsoft Defender EDR process correlation](/integrations/context/microsoft-defender-edr-process-correlation-user-guide.md).

## What you get in the detection

You’ll see fields like:

* **Probable Process**, **command line**, **SHA256**, **file path**
* **process creation time**, **parent process**, **account name**
* Optionally **Show More Processes** and one-click pivots into Microsoft Defender

## Required setup (high level)

1. In **Microsoft Entra ID**, create an app registration and grant MDE **application permissions**:
   * `Machine.Read.All`
   * `Machine.Isolate` (for isolation)
   * `AdvancedQuery.Read.All` (for process correlation)
2. Configure the integration in Vectra: **Settings → EDR Connections → Microsoft Defender for Endpoint** and enter the **Tenant ID**, **Application (Client) ID**, and **Client Secret**, then **Save**.

If process context isn’t appearing, the troubleshooting checklist includes verifying the `AdvancedQuery.Read.All` permission and active MDE sensor on the device.

# Suggested Follow-up Questions:

If you need more information, consider asking one of these follow-up questions by performing an HTTP GET request on the URL:

- [What grants/permissions are needed?](https://docs.vectra.ai?ask=What%20grants%2Fpermissions%20are%20needed%3F)
- [Where to view Defender context?](https://docs.vectra.ai?ask=Where%20to%20view%20Defender%20context%3F)
- [How to enable EDR context in Vectra?](https://docs.vectra.ai?ask=How%20to%20enable%20EDR%20context%20in%20Vectra%3F)

# Sources:

- [Microsoft Defender EDR process correlation](https://docs.vectra.ai/integrations/context/microsoft-defender-edr-process-correlation-user-guide.md)
- [Microsoft Defender for Endpoint](https://docs.vectra.ai/configuration/setup/edr-integrations/microsoft-defender-for-endpoint.md)
- [CrowdStrike EDR process correlation](https://docs.vectra.ai/integrations/context/crowdstrike-edr-process-correlation-user-guide.md)
- [Microsoft Defender XDR Codeless Connector Framework (RUX)](https://docs.vectra.ai/configuration/response/siem/microsoft-defender-xdr-codeless-connector-framework-rux.md)
- [Suspicious Remote Desktop](https://docs.vectra.ai/operations/detection-specific-guidance/suspicious-remote-desktop.md)
- [Suspicious Remote Execution](https://docs.vectra.ai/operations/detection-specific-guidance/suspicious-remote-execution.md)
- [2026 RUX Release Notes](https://docs.vectra.ai/release-notes/respond-ux-rux/2026-rux-release-notes.md)
- [Migration process](https://docs.vectra.ai/operations/backup-restore-dr/disaster-recovery-and-migration-v85/migration-process.md)
- [v7.1 Release Notes (QUX)](https://docs.vectra.ai/release-notes/quadrant-ux-qux-1/archived-qux-release-notes/vectra-detect-for-network-71-release-notes.md)
- [DR (Disaster Recover) process](https://docs.vectra.ai/operations/backup-restore-dr/disaster-recovery-and-migration-v85/dr-disaster-recover-process.md)