Threat Explorer, quarantine, submissions and AIR
The Defender for Office 365 investigation toolset, Threat Explorer and Real-time detections, the email entity page, quarantine and quarantine policies, admin and user submissions, automated investigation and response, message trace, and the Email tables in Advanced Hunting with working KQL.
What Defender XDR is and how the products correlate
Defender XDR as the correlation layer above MDE, MDI, MDO, MDA, Defender for Cloud and Entra ID Protection, how alerts become incidents, what attack disruption does, the shared hunting schema, Action center, Threat analytics, Secure Score, Exposure Management, licensing, and where Sentinel fits.