computer-investigation
CommunityAutomate comprehensive device security investigations.
System Documentation
What problem does it solve?
This skill enables automated end-to-end security investigations of Windows, macOS, and Linux devices managed in Microsoft Entra ID and Defender for Endpoint. It consolidates Defender alerts, sign-in patterns, logged-on users, software inventory, vulnerabilities, network activity, and automated investigation tracking to identify threats, compliance gaps, and risky configurations.
Core Features & Use Cases
- Unified device investigations: Collects Defender alerts, sign-ins, users, software inventory, vulnerabilities, and network activity for a single device.
- Parallel data collection: Runs Graph API, Defender API, and Sentinel/KQL queries in parallel to reduce investigation time.
- Automated reporting: Exports a JSON dossier and generates a concise risk-and-remediation summary for stakeholders.
- Use Case: Investigate a Windows workstation suspected of compromise by aggregating alert history, sign-ins, and installed software.
Quick Start
Use the computer-investigation skill to initiate a full device security investigation for a target device like HOSTNAME or ENTRAD-DEVICE-01.
Dependency Matrix
Required Modules
None requiredComponents
Standard package💻 Claude Code Installation
Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.
Please help me install this Skill: Name: computer-investigation Download link: https://github.com/SCStelz/security-investigator/archive/main.zip#computer-investigation Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
Agent Skills Search Helper
Install a tiny helper to your Agent, search and equip skill from 223,000+ vetted skills library on demand.