computer-investigation

Automate a security investigation by running parallel Graph API, Defender API, and Sentinel KQL queries to aggregate alerts, sign-ins, and network activity for a target device. The skill collects this data automatically, exports a JSON dossier, and generates a risk-and-remediation summary report.

Device-centric security investigations require Graph API, Defender API, and Sentinel KQL access to collect Defender alerts, sign-in patterns, logged-on users, software inventory, vulnerabilities, and network activity across Entra Joined, Hybrid Joined, and Entra Registered devices.

Yes, you can investigate Windows, macOS, and Linux devices managed in Entra ID and Defender for Endpoint. The skill consolidates alerts, sign-in patterns, and software inventory across all three operating systems into a unified JSON export and summary report.

Parallel data collection accelerates incident response by executing Graph API, Defender API, and Sentinel queries simultaneously rather than sequentially. This reduces investigation time when aggregating alert history, sign-in logs, and installed software for a compromised Windows workstation.

The output format for an automated device security investigation is a single JSON dossier file containing all collected telemetry, accompanied by a concise risk-and-remediation summary report designed for stakeholder review.

Yes, automated investigation tracking is included as part of the comprehensive device security investigation. The skill queries Defender for Endpoint to collect automated investigation status alongside alerts, vulnerabilities, and network activity for the target device.