skills.rest
NCLGISA
NCLGISAOFFICIAL
Explore all skills by this author →
WebsiteGitHub

microsoft-defender

Manage Microsoft Defender XDR, Endpoint, and Sentinel security operations.

Updated Aug 23, 2026
Search Tags:#incident response#vulnerability management#threat hunting#security operations#sentinel#mde#microsoft defender
One-click install
npx skills add https://github.com/NCLGISA/trellis-catalog --skill microsoft-defender
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: microsoft-defender
Source: https://github.com/NCLGISA/trellis-catalog/tree/main/bridges/microsoft-defender/skills/microsoft-defender
Command: npx skills add https://github.com/NCLGISA/trellis-catalog --skill microsoft-defender

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill streamlines complex security operations by consolidating access to Microsoft Defender XDR, Defender for Endpoint (MDE P2), and Microsoft Sentinel into a single, unified interface, reducing the need to navigate multiple portals.

Core Features & Use Cases

  • Unified Threat Hunting: Perform advanced KQL queries across endpoint and SIEM data.
  • Incident Management: Investigate, manage, and respond to security incidents.
  • Endpoint Response: Execute actions like isolating machines or collecting forensic data.
  • Vulnerability Management: Track and manage vulnerabilities across your environment.
  • Threat Indicator Management: Manage Indicators of Compromise (IoCs) for proactive defense.
  • Sentinel Operations: Manage analytics rules, watchlists, and automation rules.
  • Use Case: A security analyst can use this Skill to quickly hunt for suspicious processes across all endpoints, investigate any related incidents, isolate a compromised machine, and block identified malicious IP addresses, all from a single command-line interface.

Quick Start

Use the microsoft-defender skill to list all active high-severity incidents.

Frequently Asked Questions about microsoft-defender

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform advanced threat hunting across Microsoft Defender XDR and Sentinel?▼

Advanced threat hunting is performed by running KQL queries across endpoint and SIEM data. This unified interface allows you to hunt for suspicious processes and threat indicators across Microsoft Defender XDR, Defender for Endpoint, and Microsoft Sentinel without navigating multiple portals.

Can I execute endpoint response actions like isolating machines from a single interface?▼

Yes, you can execute endpoint response actions to isolate machines or collect forensic data. The unified security operations interface integrates machine response actions with incident management, allowing analysts to quickly contain compromised endpoints alongside threat hunting workflows.

Do I need Entra ID app registration to manage incidents and Sentinel rules?▼

Yes, Entra ID app registration is required to manage incidents, Sentinel rules, and watchlists. You must configure specific API permissions across Microsoft Threat Protection, WindowsDefenderATP, and ARM RBAC for Sentinel to authenticate and execute operations.

What is the best way to manage vulnerabilities and threat indicators in Defender for Endpoint?▼

The best way to manage vulnerabilities and threat indicators is through a unified command-line interface. You can track environment vulnerabilities, manage Indicators of Compromise for proactive defense, and block identified malicious IP addresses directly alongside incident investigations.

How does unified security operations consolidate Microsoft Defender and Sentinel portals?▼

Unified security operations consolidates Microsoft Defender XDR, Defender for Endpoint P2, and Microsoft Sentinel into a single interface. This streamlines complex security operations by enabling advanced hunting, incident management, and Sentinel watchlist operations from one access point.

What are the limitations of using KQL for cross-platform threat hunting in Microsoft Defender?▼

KQL advanced hunting is limited to data available within Microsoft Defender XDR, Defender for Endpoint, and Microsoft Sentinel. Query effectiveness depends on properly configured API permissions and ARM RBAC roles to access endpoint and SIEM telemetry across the environment.

Related Skills

Explore More Software Engineering Skills→
microsoftmicrosoft
242

entra-app-registration

Register Microsoft Entra ID apps and configure OAuth/MSAL workflows.

Official
Intermediate
slantviewslantview
1

security-auditor

Audit code and dependencies for vulnerabilities and OWASP compliance.

Community
Advanced
mbergmberg

engage-indicators

Manage indicators and metrics within Engage Analytics dbt projects.

Community
Advanced
aviskaaraviskaar
6

security-operations

Establish and manage SOC capabilities with SIEM configuration and incident response.

Official
Advanced