Agent Skills by Marius Sandbu
Showing 17 vetted skills indexed across 1 GitHub repositories.
msandbudetection-authoring
Deploy and manage Microsoft Defender XDR detection rules via Graph API.
msandbuuser-investigation
Analyzes Microsoft Entra ID user accounts for security risks and anomalies.
msandbukql-query-authoring
Generate validated KQL queries for Microsoft Sentinel and Defender XDR.
msandbuexposure-investigation
Query DeviceTvm* and ExposureGraph* tables to generate vulnerability and exposure management reports.
msandbumcp-usage-monitoring
Monitor MCP server usage across Microsoft Sentinel and Defender XDR environments.
msandbuheatmap-visualization
Generate interactive heatmaps from Microsoft Sentinel data using KQL-aggregated inputs.
msandbusentinel-ingestion-report
Analyze Microsoft Sentinel ingestion patterns, table volumes, and anomalies via PowerShell.
msandbuauthentication-tracing
Analyze Microsoft Entra ID authentication flows to detect token theft.
msandbuca-policy-investigation
Correlate Conditional Access policy changes with sign-in failure error codes.
msandbuhoneypot-investigation
Automates security analysis of honeypot servers by querying failed connections and enriching IPs with threat intelligence.
msandbuincident-investigation
Coordinate multi-phase security incident investigations across Microsoft Defender XDR and Sentinel.
msandbucomputer-investigation
Analyze Microsoft Defender and Entra ID data for device security investigations.
msandbuioc-investigation
Investigate IP addresses, domains, URLs, and file hashes with threat intelligence correlation.
msandbugeomap-visualization
Generates interactive geographic maps of IP addresses to visualize attack origins and security events.
msandbuscope-drift-detection-user
Detect scope drift in Entra ID user accounts using 90-day behavioral baselines.
msandbuscope-drift-detection-spn
Detect scope drift in Entra ID service principals using 90-day behavioral baselines.
msandbuscope-drift-detection-device
Detect scope drift and behavioral baseline deviation in DeviceProcessEvents.