Sonar is Microsoft’s high scale, behavioral analysis platform and sandbox detonation service for deep content analysis of files and URLs. It is used widely across Microsoft by our Cloud and Enterprise experiences serving more than 325M users1 and spins up 150 million analysis VMs daily to stop threats across the attack kill chain (sign-up, hosting, time of delivery, time of click, and post-delivery).

Sonar’s Detection and Defense engineering team develops several highly scalable, distributed cloud services with global presence in multiple geos and clouds (public, Gov and AGP), and is responsible for the static and dynamic analysis of content (eg. documents, emails, executables, URLs) to find potentially malicious intent.