incident-investigation

What problem does it solve?

This Skill automates end-to-end security incident investigations by orchestrating metadata retrieval, alert listing, asset enumeration, evidences extraction, and deep entity analysis using Defender XDR and Sentinel MCP tools.

Core Features & Use Cases

• Incident metadata retrieval: Pulls incident details (title, severity, status, MITRE techniques) and related context.
• Comprehensive asset & evidence gathering: Enumerates devices, users, apps, cloud resources, and evidences (malicious/suspicious processes, files, IPs, URLs, domains) with filtering and defanging.
• Phase-driven workflow & workspace management: Enforces mandatory Sentinel workspace selection, presents entity summaries, and supports parallel investigations across users, devices, and IoCs.
• In-depth investigations: Leverages user-investigation, computer-investigation, and ioc-investigation skills to surface findings and deliver structured outputs ready for reporting.
• Use Case: When a security incident is identified, the skill guides operators through a reproducible, auditable investigation from incident description to actionable results.

Quick Start

Install prerequisites and start an incident investigation by supplying an incident ID, then select assets/entities for deeper analysis and generate a structured report.