skills.rest
jay-steenbergen
jay-steenbergenCOMMUNITY
Explore all skills by this author →
GitHub

cso-defender-endpoint-onboard

Guides learners through onboarding a Windows VM to Microsoft Defender for Endpoint and analyzing alerts.

2|Updated Jun 1, 2026
Search Tags:#cybersecurity#kql#mitre att&ck#attack simulation#alert triage#defender for endpoint#advanced hunting
One-click install
npx skills add https://github.com/jay-steenbergen/MSSAMentorAgent --skill cso-defender-endpoint-onboard-jay-steenbergen
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cso-defender-endpoint-onboard
Source: https://github.com/jay-steenbergen/MSSAMentorAgent/tree/main/.github/skills/tracks/cybersecurity-ops/cso-defender-endpoint-onboard
Command: npx skills add https://github.com/jay-steenbergen/MSSAMentorAgent --skill cso-defender-endpoint-onboard-jay-steenbergen

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? New cybersecurity learners often lack hands-on experience with real endpoint detection tooling. This Skill walks a learner through onboarding a Windows VM to Microsoft Defender for Endpoint, running an attack simulation, and reading the resulting alert in the Defender XDR portal like a working SOC analyst. ## Core Features & Use Cases - Endpoint Onboarding: Generate and run the MDE local onboarding script, then verify sensor health via registry checks and the Defender portal. - Attack Simulation & Alert Triage: Run the Evaluation Lab simulation (or Microsoft's detection test script) and walk the resulting alert's process tree, evidence, timeline, and MITRE ATT&CK techniques. - Advanced Hunting with KQL: Pivot from alerts to raw telemetry using KQL queries against DeviceProcessEvents and DeviceFileEvents. - Use Case: A career-changer in a cybersecurity program onboards a lab VM, triggers a simulated attack, and practices reading a real alert end-to-end before their first SOC interview. ## Quick Start Ask the mentor to start the Defender endpoint onboarding project and walk you through onboarding your Windows VM to Microsoft Defender for Endpoint.

Frequently Asked Questions about cso-defender-endpoint-onboard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I onboard a Windows VM to Microsoft Defender for Endpoint?▼

Download the local onboarding script from security.microsoft.com under Settings, Endpoints, Onboarding, then run it as Administrator on the VM. Verify onboarding by checking the OnboardingState and SenseIsRunning registry values and confirming the device appears in the portal's Assets page.

How do I run an attack simulation in Microsoft Defender?▼

Use the Evaluation Lab under Endpoints, Evaluation & Tutorials in the Defender XDR portal to provision test devices and run a canned simulation like Document drops backdoor. If unavailable, run Microsoft's supported detection test script on any onboarded endpoint.

What license do I need for Microsoft Defender for Endpoint labs?▼

You need a Microsoft 365 E5 or A5 trial with the Security Administrator or Global Administrator role. Defender for Endpoint provisions automatically the first time you visit the Endpoints onboarding settings in security.microsoft.com.

Why is my onboarded device not showing telemetry in Defender?▼

The sensor may be registered but inactive; restart the Windows Defender Advanced Threat Protection service. If the device never appears, check that the script ran elevated and that outbound access to Microsoft defender endpoints is not blocked by a proxy or firewall.

How do I query endpoint telemetry with KQL in Advanced Hunting?▼

Use the Advanced Hunting editor in the Defender XDR portal to query tables like DeviceProcessEvents and DeviceFileEvents, filtering by DeviceName and Timestamp. Note that Advanced Hunting retains only 30 days of telemetry by default.

Related Skills

Explore More Education & Research Skills→
AradotsoAradotso
4

microsoft-agent365-devtools-cli

Orchestrate Azure provisioning, Entra ID consent, and Microsoft 365 packaging for Agent 365 applications.

Official
Advanced
yogiexyogiex

soc-analyst

Guides security analysts through alert triage, incident investigation, and escalation workflows.

Community
Intermediate
NCLGISANCLGISA

microsoft-defender

Manage Microsoft Defender XDR, Endpoint, and Sentinel security operations.

Official
Advanced
xalgordxalgord
954

deploying-edr-agent-with-crowdstrike

Deploys and configures CrowdStrike Falcon EDR sensors across Windows, macOS, and Linux endpoints.

Community
Intermediate