Feed / Defender
mediumDefenderMicrosoft Defender for Endpointdeprecationm365_message_center · Jun 1, 2026

(Updated) Upcoming change to Microsoft Defender for Endpoint Advanced Hunting: removal of SMB signature data

Microsoft is removing SMB signature inspection events from Advanced Hunting in Microsoft Defender for Endpoint to improve endpoint performance and focus on higher-value network telemetry. This change affects how security teams analyze network activity and may require adjustments to existing hunting queries.

Services: Microsoft Defender XDR. <p>Updated July 7, 2026: We have updated the timeline. Thank you for your patience.&nbsp;</p><p><b>[Introduction]</b></p> <p> To improve endpoint performance and focus on higher-value network telemetry, Microsoft is removing <b>SMB signature inspection events</b> from Advanced Huntin…
View original article →
Security
endpoint_securitythreat_protection
Audience
adminsecurity_engineer
Environment
cloudhybrid
Ontology Topics
AZ-500
Classification confidence: 95%
Loading correlations…
(Updated) Upcoming change to Microsoft Defender for Endpoint Advanced Hunting: removal of SMB signature data | 365Forge