What problem does it solve? Security teams in locked-down tenants cannot grant API, MCP, or Entra access to AI tools, which blocks automated SOC triage. This Skill coordinates an air-gapped workflow where the human runs portal queries in their own authenticated browser while local Python scripts handle KQL generation, CSV unification, and VirusTotal enrichment. ## Core Features & Use Cases - KQL Query Generation: Produces one Defender Advanced Hunting query per machine group from a single config.json containing your IOCs, device filters, and thresholds. - Local Enrichment Pipeline: Unifies exported Defender CSVs, looks up each indicator in VirusTotal v3 using your VT_API_KEY, applies verdict rules, and writes a report, a pre-filled Sentinel blast-radius query, and a soc_report.csv for Threat Sentinel. - Human-Confirmed Closure: Prepares the incident classification and comment package but never closes incidents automatically; the analyst approves and clicks Close in Sentinel. - Use Case: A CISO receives a list of suspicious domains and file hashes, runs the generated KQL in Defender, exports the CSVs, enriches them locally, and gets a ready-to-paste Sentinel query identifying every affected machine and user. ## Quick Start Ask Claude to run the SOC investigation on your list of suspicious domains and file hashes, then follow the guided Defender export and Sentinel pivot steps.
