← Home

Microsoft 365 Defender · Enterprise security

Guided Response, helping two security teams act on threats as one

A managed response experience inside the Microsoft 365 Defender portal, connecting Microsoft's Defender Experts with customer SOC teams around contextual investigations and actionable tasks, reducing time-to-action on critical enterprise threats.

Role

Product Designer for the analysts experience, assisted by a junior designer for customer experience

Team

PM, engineering, research, Defender Experts

Users

Microsoft security analysts & customer SOC teams

Area

Incident response · 0 → 1 feature

The 60-second version

What happened here, if you only have a minute

The problem: Microsoft's Defender Experts investigate threats on customers' behalf. But their findings left the product as emails and reports. Customer SOC teams lost time re-establishing context on exactly the incidents where minutes matter.

My role: end-to-end product designer for both sides of the experience. The Microsoft analyst who drafts a guided response mid-investigation, and the customer SOC analyst who acts on it inside the incident view. Partnered with PM, engineering, research, and the Defender Experts team.

Decision 01

One structure, two audiences. The format analysts author in is exactly what customers consume, so nothing is lost in translation.

Decision 02

The task card as the atomic unit. Plain-language description, status life cycle, one-click actions where possible, manual overrides for work done outside the portal.

Decision 03

Response lives inside the incident. Not a separate destination, so SOC analysts act with full context instead of switching tools at 2 a.m.

↓ Time-to-action
on critical enterprise threats. Expert guidance moved from email into the incident itself
8 analysts
concept validation (4 Defender, 4 non-Defender). Recommended actions matched their own playbooks
2-sided
one coherent system serving Microsoft analysts and customer SOCs

What research changed: the investigation summary moved to the top (analysts wanted to read it before acting), incident-list wayfinding was redesigned after the "Defender Experts" tag failed, and low-guidance actions gained deeper integration points.

Designed within Fluent to Microsoft's accessibility standards. Keyboard-first flows and screen-reader-legible task states, because SOC tooling is used under pressure, in every ability profile.

Part A · Analyst experience

Microsoft security analysts drafting a guided response

The authoring side: how a Defender Expert assembles evidence mid-investigation and drafts a guided response. For a single device, multiple devices, files, indicators and text-only tasks. Through to publishing.

Guided Response - Part A · Analyst experience, slide 1
Guided Response - Part A · Analyst experience, slide 2
Guided Response - Part A · Analyst experience, slide 3
Guided Response - Part A · Analyst experience, slide 4
Guided Response - Part A · Analyst experience, slide 5
Guided Response - Part A · Analyst experience, slide 6
Guided Response - Part A · Analyst experience, slide 7
Guided Response - Part A · Analyst experience, slide 8
Guided Response - Part A · Analyst experience, slide 9
Guided Response - Part A · Analyst experience, slide 10
Guided Response - Part A · Analyst experience, slide 11
Guided Response - Part A · Analyst experience, slide 12
Guided Response - Part A · Analyst experience, slide 13
Guided Response - Part A · Analyst experience, slide 14
Guided Response - Part A · Analyst experience, slide 15
Guided Response - Part A · Analyst experience, slide 16
Guided Response - Part A · Analyst experience, slide 17
Guided Response - Part A · Analyst experience, slide 18
Guided Response - Part A · Analyst experience, slide 19
Guided Response - Part A · Analyst experience, slide 20
Guided Response - Part A · Analyst experience, slide 21
Guided Response - Part A · Analyst experience, slide 22
Guided Response - Part A · Analyst experience, slide 23
Guided Response - Part A · Analyst experience, slide 24
Guided Response - Part A · Analyst experience, slide 25
Guided Response - Part A · Analyst experience, slide 26
Guided Response - Part A · Analyst experience, slide 27
Guided Response - Part A · Analyst experience, slide 28
Guided Response - Part A · Analyst experience, slide 29
Guided Response - Part A · Analyst experience, slide 30
Guided Response - Part A · Analyst experience, slide 31
Guided Response - Part A · Analyst experience, slide 32
Guided Response - Part A · Analyst experience, slide 33
Guided Response - Part A · Analyst experience, slide 34
Guided Response - Part A · Analyst experience, slide 35
Guided Response - Part A · Analyst experience, slide 36
Guided Response - Part A · Analyst experience, slide 37
Guided Response - Part A · Analyst experience, slide 38
Guided Response - Part A · Analyst experience, slide 39
Guided Response - Part A · Analyst experience, slide 42
Guided Response - Part A · Analyst experience, slide 43
Guided Response - Part A · Analyst experience, slide 44
Guided Response - Part A · Analyst experience, slide 45
Part B · Customer experience

Customer SOC taking action on the published response

The consumption side: task card anatomy and life cycle, the incident queue and side panel, and the action flows. Isolating a device, quarantining a file, remediating multiple instances.

Guided Response - Part B · Customer experience, title slide
Guided Response - Part B · Customer experience, slide 1
Guided Response - Part B · Customer experience, slide 3
Guided Response - Part B · Customer experience, slide 4
Guided Response - Part B · Customer experience, slide 5
Guided Response - Part B · Customer experience, slide 6
Guided Response - Part B · Customer experience, slide 7
Guided Response - Part B · Customer experience, slide 8
Guided Response - Part B · Customer experience, slide 9
Guided Response - Part B · Customer experience, slide 10
Guided Response - Part B · Customer experience, slide 11
Guided Response - Part B · Customer experience, slide 12
Guided Response - Part B · Customer experience, slide 13
Guided Response - Part B · Customer experience, slide 14
Guided Response - Part B · Customer experience, slide 15
Guided Response - Part B · Customer experience, slide 16
Guided Response - Part B · Customer experience, slide 17
Guided Response - Part B · Customer experience, slide 18
Guided Response - Part B · Customer experience, slide 19
Guided Response - Part B · Customer experience, slide 20
Part C · Research & impact

Validating with security analysts, iterating, and the results

Concept validation with 8 security analysts (Defender and non-Defender users), what worked, what didn't, the iteration that followed, and the impact on time-to-action.

Guided Response - Part C · Research & impact, slide 1
Guided Response - Part C · Research & impact, slide 2
Guided Response - Part C · Research & impact, slide 3
Guided Response - Part C · Research & impact, slide 4
Guided Response - Part C · Research & impact, slide 5
Guided Response - Part C · Research & impact, slide 6
Guided Response - Part C · Research & impact, slide 7
Guided Response - Part C · Research & impact, slide 8
Guided Response - Part C · Research & impact, slide 9
Guided Response - Part C · Research & impact, slide 10
Guided Response - Part C · Research & impact, slide 11
Next project

AI Powered Figma Content Review Plugin. An AI tool I designed and built

→