By SCStelz

A skill your agent uses when asked to investigate Conditional Access policy changes, sign-in failures related to CA policies (error codes 53000, 50074, 530032), or suspected policy…

SCStelz/security-investigator

Weekly review of an investigation tenant-context memory file against the most recent SOC scan reports (e.g.

SCStelz/security-investigator

A skill your agent uses when asked to create heatmaps, visualize patterns over time, show activity grids, or display aggregated data in a matrix format.

SCStelz/security-investigator

Report/investigate RUNTIME ACTIVITY of AI agents (Agent 365 / Copilot Studio / M365 Copilot / Work IQ) — agents used, tools/connectors, channels, tokens, prompt/reply content, and Prompt Shield…

SCStelz/security-investigator

Audit or report on AI agent security posture across Copilot Studio, Microsoft 365 Copilot, Microsoft Foundry, and third-party agents.

SCStelz/security-investigator

Audit Entra ID app registration and service principal security posture.

SCStelz/security-investigator

A skill your agent uses when asked to trace authentication flows, analyze SessionId chains, investigate token reuse vs interactive MFA, or assess geographic anomalies in sign-ins.

SCStelz/security-investigator

Analyze data security events, sensitive information type (SIT) access, sensitivity label access, DLP matches, or Purview insider risk activity.

SCStelz/security-investigator

Generate email threat protection reports and assess email security posture.

SCStelz/security-investigator

A skill your agent uses when asked to generate a vulnerability and exposure management report, assess security posture, or review CVEs, security configurations, and attack paths.

SCStelz/security-investigator

A skill your agent uses when asked to investigate a computer, device, endpoint, or machine for security issues, suspicious activity, malware, or compliance review.

SCStelz/security-investigator

A skill your agent uses when asked to create geographic maps, visualize attack origins on a world map, show location-based data, or display IP geolocation.

SCStelz/security-investigator

A skill your agent uses when asked to analyze, investigate, or report on honeypot server security.

SCStelz/security-investigator

Audit identity security posture across the organization. An agent skill from SCStelz/security-investigator.

SCStelz/security-investigator

A skill your agent uses when asked to investigate a security incident by ID from Microsoft Defender XDR or Microsoft Sentinel.

SCStelz/security-investigator

A skill your agent uses when asked to write, create, or help with KQL (Kusto Query Language) queries for Microsoft Sentinel, Defender XDR, or Azure Data Explorer.

SCStelz/security-investigator

A skill your agent uses when asked to generate SVG data visualization dashboards from investigation data or skill reports.

SCStelz/security-investigator

Turn a published threat-intelligence article into a tested threat-hunting campaign.

SCStelz/security-investigator

Recommended starting point for new users and daily SOC operations.

SCStelz/security-investigator

Create, deploy, update, and manage custom detection rules in Microsoft Defender XDR via the Graph API (/beta/security/rules/detectionRules).

SCStelz/security-investigator

MITRE ATT&CK Coverage Report — YAML-driven PowerShell pipeline gathers analytic rule MITRE tags, custom detection techniques, SOC Optimization recommendations, and alert/incident operational data…

SCStelz/security-investigator

Sentinel Ingestion Report — YAML-driven PowerShell pipeline gathers all data via az monitor/az rest/Graph API, writes a deterministic scratchpad, LLM renders the report.

SCStelz/security-investigator