Guidance for Microsoft Defender for Endpoint (MDE) — enterprise endpoint security with next-gen AV, EDR, attack surface reduction (ASR), Defender Vulnerability Management, automated investigation…
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-endpoint -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-endpoint --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/defender-for-endpoint .claude/skills/defender-for-endpoint && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "defender-for-endpoint" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-endpoint into .claude/skills/defender-for-endpoint/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-endpoint", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-endpointType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-endpoint -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-endpoint --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/defender-for-endpoint .agents/skills/defender-for-endpoint && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "defender-for-endpoint" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-endpoint into .agents/skills/defender-for-endpoint/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-endpoint", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-endpoint -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-endpoint --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/defender-for-endpoint .cursor/skills/defender-for-endpoint && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "defender-for-endpoint" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-endpoint into .cursor/skills/defender-for-endpoint/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-endpoint", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/vinayaklatthe/microsoft-security-skills.git --path skills/defender-for-endpoint--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-endpoint -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-endpoint --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/defender-for-endpoint .gemini/skills/defender-for-endpoint && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "defender-for-endpoint" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-endpoint into .gemini/skills/defender-for-endpoint/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-endpoint", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-endpointInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-endpoint -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/defender-for-endpoint .github/skills/defender-for-endpoint && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "defender-for-endpoint" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-endpoint into .github/skills/defender-for-endpoint/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-endpoint", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-endpoint -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-endpoint --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/defender-for-endpoint .opencode/skills/defender-for-endpoint && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "defender-for-endpoint" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-endpoint into .opencode/skills/defender-for-endpoint/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-endpoint", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
defender-for-endpointGuidance for Microsoft Defender for Endpoint (MDE) — enterprise endpoint security with next-gen AV, EDR, attack surface reduction (ASR), Defender Vulnerability Management, automated investigation…
Defender For Endpoint is an agent skill from vinayaklatthe/microsoft-security-skills. Guidance for Microsoft Defender for Endpoint (MDE) — enterprise endpoint security with next-gen AV, EDR, attack surface reduction (ASR), Defender Vulnerability Management, automated investigation and remediation (AIR), and live response. Covers Plan 1 vs Plan 2 selection, onboarding paths (Intune, Configuration Manager, GPO, scripts), ASR rule rollout in audit→block, EDR in block mode, tamper protection, device groups and RBAC, and response actions (isolate, restrict, live response). WHEN: Defender for Endpoint…
Its SKILL.md is about 2.3k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Speech recognition and synthesis, Vulnerability scanning and Threat modeling. It works with Microsoft Defender, Linux, macOS and Microsoft Azure. The repository describes itself as: Curated Microsoft Security skills for AI agents - Defender, Sentinel, Entra, Purview, Intune, Security Copilot. The licence is MIT.
9 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit 15f16df. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Links to these hosts (documentation or services it may open):
learn.microsoft.comFrom URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Defender For Endpoint loads about 2.3k tokens when it runs. Until then it costs about 258 tokens; SKILL.md has 1,005 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from vinayaklatthe/microsoft-security-skills at commit 15f16df, republished under its MIT licence (© vinayaklatthe). 1,005 words, ~2,307 tokens.
.claude/skills/defender-for-endpoint/SKILL.md (or your agent's skills folder).Microsoft Defender for Endpoint (MDE) is the enterprise endpoint security platform providing prevention (next-gen AV, ASR), detection and response (EDR), threat & vulnerability management (Defender Vulnerability Management), and automated investigation and remediation (AIR). It feeds the endpoint pillar of Defender XDR.
Protecting Windows, macOS, Linux, iOS, and Android endpoints. This is the right skill for onboarding decisions, policy design, ASR rollout, EDR tuning, and response action scoping.
Do not use this skill for cross-workload investigation (defender-xdr), Azure resource
hardening (defender-for-cloud-hardening), or identity-side detection (defender-for-identity).
| If you need... | Plan / SKU | Notes |
|---|---|---|
| Next-gen AV, ASR, web/network protection, manual response | MDE Plan 1 | Bundled with M365 E3 since 2022 |
| EDR, AIR, advanced hunting, custom detections, Threat & Vuln Management | MDE Plan 2 | Bundled with M365 E5 / MDE P2 |
| Full vulnerability remediation workflows, browser extension assessments | Defender Vulnerability Management add-on | Adds to P2 |
| Server endpoints (Windows / Linux) | MDE for Servers via Defender for Cloud | Per-server billing, includes MDE P2 |
| Estate | Preferred onboarding path |
|---|---|
| Cloud-managed Windows (Intune-managed) | Intune + Security Settings Management |
| Co-managed (MECM + Intune) | Configuration Manager workload slider, then move to Intune |
| AD-joined only, no MDM | GPO onboarding script |
| Server (Windows/Linux) | Defender for Cloud auto-provisioning |
| macOS / Linux workstations | Intune with MDM enrollment |
| Air-gapped / one-off | Local script (90-day expiry) |
Rule of thumb: if a device exists in Intune, onboard via Intune Security Settings Management - one place to manage AV + ASR + EDR. GPO is the legacy fallback, not the default for new builds.
Confirm plan + estate inventory — Inventory devices by OS, management state, and current
AV. Map to plan/onboarding path table above.
Verify: Get-MpComputerStatus on a sample Win11 device shows AMServiceEnabled = True;
Intune shows the device as compliant.
Enable tamper protection everywhere first — Before any other policy. Without it, attackers (and well-meaning admins) can disable everything else. Verify: device shows tamper protection On in security.microsoft.com → Settings → Endpoints → Advanced features.
Onboard in waves — 100 pilot devices for 7 days, then a representative wave (1,000 or 10% of estate), then the rest. Watch the Device inventory for stuck devices (Last seen
24h after onboarding). Verify: device count in MDE matches Intune device count within 5%.
Next-gen AV policy — Real-time protection on, cloud-delivered protection on (High block level for high-risk groups), PUA blocking in audit then block, tamper protection on, network protection in block, controlled folder access in audit (then block on user workstations only - servers break). Verify: Defender configuration management report shows green on these toggles for the pilot group.
ASR rules - audit, measure, block — Enable all rules in audit for 14 days. Use the ASR rules report to see which rules would have blocked what. Move noisy rules to a tighter scope (e.g. exclude line-of-business apps), then block the rest. Verify: ASR rules report shows zero blocks for known-good apps in audit; promote to block one rule per week.
EDR in block mode — Enable even if Defender AV is primary. If a non-Microsoft AV is primary, EDR in block mode is mandatory - it's the only way EDR detections result in automatic remediation. Verify: Device health page shows EDR block mode = On.
Device groups & RBAC — Build device groups by risk tier (workstation, server, tier-0 admin workstation, kiosk). Scope response actions (isolate, live response) per group. Tier-0 admin devices = tightest policy, fewest analysts with response rights.
Vulnerability management — Prioritise by exposure score + threat insight, not raw CVE count. Push remediation tasks to Intune via the integration.
AIR — Configure remediation level per device group. Workstations = Full, servers = Semi (require analyst approval). Review pending actions in the Action Center daily.
Plan MDE Plan 1 vs Plan 2 for a 10,000-user M365 E3 tenant - what do we lose without P2?Onboard 5,000 Intune-managed Windows 11 devices to MDE with security settings management.Roll out ASR rules safely - audit first, then block. Which rules are safe to block immediately?Enable EDR in block mode with CrowdStrike as primary AV.Design MDE device groups for a 3-tier estate: workstations, servers, tier-0 admin devices.Configure AIR remediation levels - workstations vs servers.Prioritise vulnerability remediation using exposure score and threat insight.Scope Live Response to a 5-person response team with audit logging.© vinayaklatthe, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in skills/defender-for-endpoint of vinayaklatthe/microsoft-security-skills.
Open the folder on GitHubat commit 15f16df
Defender For Endpoint next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Defender For Endpoint this skillvinayaklatthe/microsoft-security-skills | 175 | — | ~2.3k | Automated safety check: Pass | MIT | |
| Configuring Windows Defender Advanced Settingsmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~3.1k | Automated safety check: Pass | Apache-2.0 | |
| Recon Osinthypnguyen1209/offensive-claude | 388 | — | ~2.2k | Automated safety check: Pass | MIT | |
| Remediate Image Cveskubernetes-sigs/cloud-provider-azure | 294 | — | ~3.9k | Automated safety check: Pass | Apache-2.0 | |
| Azure External Attack Surface ManagementMicrosoftDocs/Agent-Skills | 776 | — | ~935 | Automated safety check: Pass | CC-BY-4.0 | |
| Murmurxiaopengde/murmur | 109 | — | ~2.9k | Automated safety check: Notes | MIT |
mukul975/Anthropic-Cybersecurity-Skills
Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, network protection, and exploit protection.
hypnguyen1209/offensive-claude
A skill your agent uses when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover…
kubernetes-sigs/cloud-provider-azure
Orchestrate end-to-end CVE remediation for the Linux CCM, CNM, and health-probe-proxy images on cloud-provider-azure master or a release-X.Y branch, including builds, repeated Trivy verification…
MicrosoftDocs/Agent-Skills
Expert knowledge for Azure External Attack Surface Management development including configuration.
xiaopengde/murmur
把一段中文（或任意 Whisper 支持语言）的会议/面试录音用本地 Whisper large-v3 转成文本，再清洗成带说话人标签、修过 ASR 错字、分好章节的 markdown 文档（可选再转成 docx）。跨平台（macOS Apple Silicon 用 mlx-whisper，Windows/Linux/Intel Mac 用…
ysyecust/lecture-to-notes
把本地长视频/音频转写成文字稿 + 可选字幕，纯本地（不上传云端），用 sherpa-onnx X-ASR Zipformer transducer 模型（int8 量化、中英双语、自动标点）。已在 macOS Apple Silicon（int8 + AMX，~100× 实时）、Linux ARM64（CPU，~32× 实时）与 Windows（PowerShell…
vinayaklatthe/microsoft-security-skills
Guidance for designing secure APIs on Azure - authentication, authorization, gateway controls, input validation, rate limiting, secret management, and runtime threat detection - aligned to OWASP API…
vinayaklatthe/microsoft-security-skills
Guidance for securing Azure App Service web apps and APIs — managed identity, Easy Auth with Microsoft Entra ID, network isolation via private endpoints + VNet integration, HTTPS / TLS hardening…
vinayaklatthe/microsoft-security-skills
Guidance for Azure Arc — projecting on-premises, multicloud (AWS/GCP), and edge servers, Kubernetes, and data services into Azure Resource Manager for unified governance, security, and management.
vinayaklatthe/microsoft-security-skills
Guidance for secure remote VM management in Azure using Azure Bastion combined with Defender for Cloud just-in-time (JIT) VM access.
vinayaklatthe/microsoft-security-skills
Guidance for Azure Confidential Computing — protecting data in use through hardware-based Trusted Execution Environments (TEEs).
vinayaklatthe/microsoft-security-skills
Guidance for Azure DDoS Protection — Network Protection (per-VNet) and IP Protection (per public IP) tiers built on the same always-on Microsoft platform.
Guidance for Microsoft Defender for Endpoint (MDE) — enterprise endpoint security with next-gen AV, EDR, attack surface reduction (ASR), Defender Vulnerability Management, automated investigation…. Defender For Endpoint is an agent skill from vinayaklatthe/microsoft-security-skills. Guidance for Microsoft Defender for Endpoint (MDE) — enterprise endpoint security with next-gen AV, EDR, attack surface reduction (ASR), Defender Vulnerability Management, automated investigation and remediation (AIR), and live response.
Defender For Endpoint fits situations like: non-endpoint Defender workloads (use defender-xdr for cross-workload; defender-for-cloud-hardening for Azure resources).
Run `npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-endpoint -a claude-code`. Or copy the skill folder (skills/defender-for-endpoint in vinayaklatthe/microsoft-security-skills) into .claude/skills/defender-for-endpoint in your project. Claude Code loads it when a task matches its description.
Run `npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-endpoint -a codex`. Or copy the skill folder (skills/defender-for-endpoint in vinayaklatthe/microsoft-security-skills) into .agents/skills/defender-for-endpoint in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-endpoint -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/defender-for-endpoint, .gemini/skills/defender-for-endpoint, .github/skills/defender-for-endpoint and .opencode/skills/defender-for-endpoint in your project.
SKILL.md names no scripts, command-line tools or credentials: Defender For Endpoint is instructions for the agent only.
SKILL.md names 1 domain. As links in the text: learn.microsoft.com. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Defender For Endpoint is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
About 2.3k tokens (SKILL.md is roughly 9.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Defender For Endpoint: Configuring Windows Defender Advanced Settings (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Recon Osint (hypnguyen1209/offensive-claude, 388 stars), Remediate Image Cves (kubernetes-sigs/cloud-provider-azure, 294 stars) and Azure External Attack Surface Management (MicrosoftDocs/Agent-Skills, 776 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
vinayaklatthe (a GitHub user) maintains it in vinayaklatthe/microsoft-security-skills, which has 175 GitHub stars. The repository holds 50 skills in this directory. The repository was last updated on June 18, 2026.
Source: vinayaklatthe/microsoft-security-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
