defender-alert

What problem does it solve?

Security analysts and IT responders often receive Microsoft Defender alerts without clear next steps, forcing manual triage to determine severity, affected assets, and remediation guidance.

Core Features & Use Cases

• Alert triage: Classifies severity and summarizes what happened from Defender findings.
• Affected asset identification: Identifies impacted devices to focus investigation and containment.
• Actionable remediation: Provides remediation steps and recommendations when risk or follow-up is indicated.
• Use case: When an endpoint generates a high-severity Defender alert, triage it quickly to confirm scope, identify devices, and execute the recommended remediation workflow.

Quick Start

Run the defender-alert skill and provide an alert identifier or severity value to produce a prioritized triage summary with remediation guidance.