skills.rest
msandbu
msandbuCOMMUNITY
Explore all skills by this author →
GitHub

exposure-investigation

Query DeviceTvm* and ExposureGraph* tables to generate vulnerability and exposure management reports.

2|Updated Mar 4, 2026
Search Tags:#vulnerability management#security posture#exposure assessment#CVE analysis#attack paths#defender health
One-click install
npx skills add https://github.com/msandbu/sentinelday --skill exposure-investigation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exposure-investigation
Source: https://github.com/msandbu/sentinelday/tree/main/.github/skills/exposure-investigation
Command: npx skills add https://github.com/msandbu/sentinelday --skill exposure-investigation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the generation of comprehensive vulnerability and exposure management reports, helping organizations understand and improve their security posture by identifying critical risks.

Core Features & Use Cases

  • Comprehensive Reporting: Generates detailed reports covering CVEs, security configurations, end-of-support software, critical assets, attack paths, and Defender device health.
  • Scoped Analysis: Supports both organization-wide assessments and focused reviews of individual devices.
  • Use Case: When asked to "assess our overall vulnerability status and identify critical attack paths," this Skill will query various Microsoft Defender and Exposure Graph tables to produce a prioritized list of risks and actionable remediation insights.

Quick Start

Generate a full vulnerability and exposure report for the entire organization.

Frequently Asked Questions about exposure-investigation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a vulnerability and exposure management report for my organization?▼

Assess your security posture by querying DeviceTvm* and ExposureGraph* tables to identify CVEs, configuration compliance, and attack paths. The Skill automates this exposure assessment and outputs a comprehensive markdown report.

What is included in an organizational security posture assessment?▼

A security posture assessment identifies CVEs, security configurations, end-of-support software, critical assets, attack paths, and Defender device health to deliver actionable remediation insights.

Can I scope a vulnerability assessment to review an individual device instead of the entire organization?▼

Yes, the vulnerability assessment supports both organization-wide and per-device scoping. You can focus the exposure investigation on individual devices to review specific CVEs, configuration compliance, and attack paths.

How do I identify critical attack paths using Microsoft Defender data?▼

Identify critical attack paths by querying ExposureGraph* tables to map vulnerabilities and assets. The Skill analyzes this data to highlight potential routes attackers could exploit within your environment.

Does this exposure assessment require any specific dependencies or external tools?▼

No specific dependencies are required to run the exposure assessment. It relies on querying built-in DeviceTvm* and ExposureGraph* tables within your environment to generate the security posture report.

What format does the vulnerability management report output?▼

The vulnerability management report outputs as a markdown file. It also supports inline chat responses to provide immediate insights into your security posture and exposure findings.

Related Skills

Explore More Data & Analytics Skills→
msandbumsandbu
2

detection-authoring

Deploy and manage Microsoft Defender XDR detection rules via Graph API.

Community
Advanced
webrix-aiwebrix-ai
1

vulnerability-prioritization

Correlate CVE scan results with infrastructure to prioritize patching and create Jira tickets.

Official
Advanced
msandbumsandbu
2

computer-investigation

Analyze Microsoft Defender and Entra ID data for device security investigations.

Community
Advanced
matteocervellimatteocervelli
25

vulnerability-assessor

Assess software vulnerabilities with CVSS scoring and remediation planning.

Community
Advanced