Security
Overview
Translates user requests into transparent KQL and executes bounded, read-only Defender XDR queries through a direct OAuth/OBO API, then produces reproducible evidence packages and analyst review without response execution.
Capabilities
Direct Oauth/Obo Defender Xdr Kql ApiRead-Only Cross-Domain InvestigationsEvidence Packages And Analyst Review
Example Prompts
Click any prompt to copy it.
