Investigating M365 Entra
trilwu/secskills
Investigate security incidents in Microsoft 365 and Entra ID (Azure AD) -- search the Unified Audit Log, correlate sign-in and audit events, trace illicit OAuth consent grants, analyze mailbox rule…
Guidance for Microsoft Defender XDR — the unified extended detection and response suite that correlates signals across endpoints, identities, email, and cloud apps into prioritised incidents with…
Install Defender Xdr
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-xdr -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-xdr --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/defender-xdr .claude/skills/defender-xdr && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "defender-xdr" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-xdr into .claude/skills/defender-xdr/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-xdr", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-xdrType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-xdr -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-xdr --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/defender-xdr .agents/skills/defender-xdr && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "defender-xdr" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-xdr into .agents/skills/defender-xdr/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-xdr", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-xdr -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-xdr --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/defender-xdr .cursor/skills/defender-xdr && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "defender-xdr" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-xdr into .cursor/skills/defender-xdr/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-xdr", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/vinayaklatthe/microsoft-security-skills.git --path skills/defender-xdr--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-xdr -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-xdr --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/defender-xdr .gemini/skills/defender-xdr && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "defender-xdr" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-xdr into .gemini/skills/defender-xdr/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-xdr", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-xdrInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-xdr -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/defender-xdr .github/skills/defender-xdr && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "defender-xdr" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-xdr into .github/skills/defender-xdr/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-xdr", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-xdr -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-xdr --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/defender-xdr .opencode/skills/defender-xdr && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "defender-xdr" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-xdr into .opencode/skills/defender-xdr/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-xdr", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
defender-xdr- GitHub stars
- 175
- Token cost
- ~2.1k tokens
- SKILL.md length
- 976 words
- Files
- 1
- Skills in repo
- 50
- Repo updated
- First seen
- Licence
- MIT
At a glance
Guidance for Microsoft Defender XDR — the unified extended detection and response suite that correlates signals across endpoints, identities, email, and cloud apps into prioritised incidents with…
- Works in 7 steps: Onboard the core workloads first — In… → Configure unified RBAC before broad… → Investigate by incident, not by alert —… → …
- The need is SIEM log ingestion
- SKILL.md covers When to use, Map the signal to the source…, Approach and Guardrails, plus 3 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Defender Xdr is an agent skill from vinayaklatthe/microsoft-security-skills. Guidance for Microsoft Defender XDR — the unified extended detection and response suite that correlates signals across endpoints, identities, email, and cloud apps into prioritised incidents with attack-graph context. Covers onboarding the four core workloads, incident investigation, advanced hunting in KQL, custom detection rules, automatic attack disruption, AIR, and unified RBAC. WHEN: Microsoft Defender XDR, XDR incident investigation, correlate alerts across workloads, advanced hunting KQL, automatic attack…
Its SKILL.md is about 2.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Backend & APIs, covering Security operations, Cloud office suites and Authorization and RBAC. It works with Microsoft Defender, Microsoft Sentinel, Microsoft 365 and Microsoft Entra ID. The repository describes itself as: Curated Microsoft Security skills for AI agents - Defender, Sentinel, Entra, Purview, Intune, Security Copilot. The licence is MIT.
When your agent uses it
- The need is SIEM log ingestion
- Custom KQL detections from third-party sources (use sentinel)
- Merging Sentinel into the Defender portal (use unified-secops-platform)
- Endpoint-only EDR (use defender-for-endpoint)
Example prompts
- “/defender-xdr”
Workflow steps
7 steps, taken from the first numbered list in SKILL.md.
- Onboard the core workloads first — In order: MDE (highest endpoint signal), MDI (lateral
- Configure unified RBAC before broad enablement — Move from per-workload roles to
- Investigate by incident, not by alert — Incidents group related alerts, assets, and
- Enable automatic attack disruption — Defender XDR can contain high-confidence active
- Advanced hunting — Query the shared schema in KQL (DeviceEvents, IdentityLogonEvents,
- Automated Investigation & Remediation (AIR) — Configure remediation level per device
- Coverage review monthly — Use the MITRE ATT&CK coverage view to find blind spots.
What it can do on your machine
Read from SKILL.md and the folder at commit 15f16df. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
learn.microsoft.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Defender Xdr loads about 2.1k tokens when it runs. Until then it costs about 257 tokens; SKILL.md has 976 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from vinayaklatthe/microsoft-security-skills at commit 15f16df, republished under its MIT licence (© vinayaklatthe). 976 words, ~2,124 tokens.
Download SKILL.mdSave it as
.claude/skills/defender-xdr/SKILL.md (or your agent's skills folder).- name
- defender-xdr
- description
- Guidance for Microsoft Defender XDR — the unified extended detection and response suite that correlates signals across endpoints, identities, email, and cloud apps into prioritised incidents with attack-graph context. Covers onboarding the four core workloads, incident investigation, advanced hunting in KQL, custom detection rules, automatic attack disruption, AIR, and unified RBAC. WHEN: Microsoft Defender XDR, XDR incident investigation, correlate alerts across workloads, advanced hunting KQL, automatic attack disruption, AIR, Defender portal incidents, cross-domain detection, how do I investigate an attack across multiple Microsoft 365 products, alert correlation across endpoint and identity, unified incident view, attack graph, custom detection rule, unified RBAC. DO NOT USE when the need is SIEM log ingestion or custom KQL detections from third-party sources (use sentinel), merging Sentinel into the Defender portal (use unified-secops-platform), or endpoint-only EDR (use defender-for-endpoint).
- license
- MIT
- metadata.author
- Microsoft
- metadata.version
- 0.1.0
Microsoft Defender XDR
Microsoft Defender XDR is a unified pre- and post-breach defence suite. It natively correlates signals across endpoints (MDE), identities (MDI + Entra ID Protection), email/collaboration (MDO), and cloud apps (MDA) to deliver a single prioritised incident with the full attack story - graph, timeline, evidence, and recommended actions.
When to use
Running coordinated detection and response across the Microsoft 365 estate from one portal (security.microsoft.com), instead of investigating each workload in isolation. Also when you need the attack disruption feature - it requires the XDR correlation.
Do not use this skill when ingesting third-party logs or writing custom KQL detections
across non-Microsoft sources (sentinel), merging Sentinel + Defender into one portal
(unified-secops-platform), or tuning endpoint-only policies (defender-for-endpoint).
Map the signal to the source workload
XDR is only as good as the workloads feeding it. Use this to confirm what's onboarded and which alerts are missing.
| If the signal is... | Source workload | Required licence |
|---|---|---|
| Process tree, network connection, file hash on a device | Defender for Endpoint (MDE) P2 | M365 E5 / MDE P2 |
| Kerberos anomaly, DCSync, AD CS abuse, on-prem lateral movement | Defender for Identity (MDI) | M365 E5 / EMS E5 |
| Risky sign-in, leaked credentials, anomalous token use | Entra ID Protection | Entra ID P2 |
| Phishing URL click, malicious attachment detonation, BEC | Defender for Office 365 P2 | M365 E5 / MDO P2 |
| Risky OAuth app, anomalous SaaS upload, MCAS-style alert | Defender for Cloud Apps (MDA) | MDA standalone or E5 |
| Azure resource alert, AKS pod compromise | Defender for Cloud | DfC plan-based |
Rule of thumb: if an incident shows "1 alert, 1 entity," a workload is missing. A real attack always touches at least two of the above.
Approach
Onboard the core workloads first — In order: MDE (highest endpoint signal), MDI (lateral movement), Entra ID Protection, MDO. Add MDA when SaaS apps are in scope. Each workload onboarded to its own portal still surfaces in the unified Defender portal. Verify:
Incidentsview shows alerts from at least 3 differentServiceSourcevalues after 24 hours.Configure unified RBAC before broad enablement — Move from per-workload roles to Microsoft Defender XDR Unified RBAC (security.microsoft.com → Permissions). Build custom roles scoped by data source + permission level. Pilot in active-directory mode for 30 days before enforcing. Verify: a Tier-1 analyst can triage and contain but not modify policies; a Tier-3 can tune detections but not change RBAC.
Investigate by incident, not by alert — Incidents group related alerts, assets, and evidence with an attack graph. Always start from the Incidents queue. The attack graph shows the kill chain across workloads in one view. Verify: open a multi-alert incident; the graph shows entities (user, device, mailbox, IP) linked across workloads.
Enable automatic attack disruption — Defender XDR can contain high-confidence active attacks (disable a user, isolate a device, contain a mailbox) using cross-signal confidence ≥ 99%. Roll out in report-only for 14 days, review actions, then enforce. Verify: review
Action centerfor past 14 days; no false positives in disruption actions.Advanced hunting — Query the shared schema in KQL (
DeviceEvents,IdentityLogonEvents,EmailEvents,CloudAppEvents). Promote useful hunts into custom detection rules with incident grouping and impacted entities mapped. Verify: each custom rule has entity mappings; without them, alerts don't join into incidents.Automated Investigation & Remediation (AIR) — Configure remediation level per device group (
No remediation→Semi→Full). Most environments run Full on workstations, Semi on servers.Coverage review monthly — Use the MITRE ATT&CK coverage view to find blind spots. Track median time-to-acknowledge and time-to-contain as the only two SOC metrics that matter for XDR ROI.
Show full SKILL.md (394 more words)Show less
Guardrails
- All four workloads or you don't have XDR. A "Defender XDR with only MDE" deployment is EDR with a fancy portal. The correlation needs at least MDE + MDI + Entra ID Protection.
- Unified RBAC first, then enable broadly. Without it, analysts get tenant-wide rights via per-workload role groups. Lock down RBAC before granting access.
- Run attack disruption in report-only first. It will isolate devices and disable users. Pilot the actions for 14 days, review the Action Center, then enforce.
- Custom detection rules need entity mappings. Without them, alerts don't correlate into incidents and the attack graph is broken.
- Don't suppress incidents at the queue level. Suppress at the alert source (MDE/MDI/MDO) so the underlying detection still tunes. Queue suppression hides the symptom, not the cause.
- The Defender portal is the SOC pane. Don't have analysts swivel between MDE, MDI, MDO portals - that's the problem XDR exists to solve.
Common anti-patterns
- "We onboarded MDE only and call it XDR" - Half the kill chain is invisible. Onboard MDI and Entra ID Protection before claiming XDR coverage.
- "Each Defender workload has its own analyst team" - Defeats the unified investigation model. One incident, one analyst, all workloads.
- "Enabled attack disruption tenant-wide on day one" - Will disrupt legitimate activity (e.g. a pen test that looks like ransomware). Report-only 14 days first.
- "Custom rules without entity mappings" - Alerts don't aggregate into incidents. Always map at least one entity (user/device/IP).
- "Use unified RBAC for some workloads and legacy RBAC for others" - Permission overlap creates over-privilege. Migrate all workloads or none.
- "AIR set to No remediation everywhere because we don't trust automation" - Analyst hours wasted on rote tasks. Start Semi on workstations and review.
Example prompts
What are the first Defender XDR controls I should enable for a new Microsoft 365 tenant?Walk me through how to investigate a multi-stage incident in Defender XDR using the attack graph.Write an advanced hunting KQL query to find suspicious PowerShell execution across devices.How does automatic attack disruption work and what should I configure first?How do I correlate an identity alert with a device alert in the same incident?Design the unified RBAC roles for a 3-tier SOC.Convert this hunting query into a custom detection rule with entity mappings.
Microsoft Learn
- Overview: https://learn.microsoft.com/defender-xdr/microsoft-365-defender
- Advanced hunting: https://learn.microsoft.com/defender-xdr/advanced-hunting-overview
- Attack disruption: https://learn.microsoft.com/defender-xdr/automatic-attack-disruption
- Custom detection rules: https://learn.microsoft.com/defender-xdr/custom-detection-rules
- Unified RBAC: https://learn.microsoft.com/defender-xdr/manage-rbac
- Incident investigation: https://learn.microsoft.com/defender-xdr/investigate-incidents
- AIR overview: https://learn.microsoft.com/defender-xdr/m365d-autoir
© vinayaklatthe, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/defender-xdr of vinayaklatthe/microsoft-security-skills.
Open the folder on GitHubat commit 15f16df
Compare with similar skills
Defender Xdr next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Defender Xdr this skillvinayaklatthe/microsoft-security-skills | 175 | — | ~2.1k | Automated safety check: Pass | MIT | |
| Investigating M365 Entratrilwu/secskills | 157 | — | ~4.1k | Automated safety check: Pass | MIT | |
| Sap Btp Build Work Zone Advancedsecondsky/sap-skills | 462 | — | ~3.3k | Automated safety check: Pass | GPL-3.0 | |
| Detecting Email Account Compromisemukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~823 | Automated safety check: Pass | Apache-2.0 | |
| CLI Microsoft365pnp/cli-microsoft365-mcp-server | 132 | — | ~3.5k | Automated safety check: Pass | MIT | |
| CLI Microsoft365 Scriptpnp/cli-microsoft365-mcp-server | 132 | — | ~3.3k | Automated safety check: Pass | MIT |
Similar skills
Sap Btp Build Work Zone Advanced
secondsky/sap-skills
Develops and administers SAP Build Work Zone, advanced edition digital workplace solutions.
Detecting Email Account Compromise
mukul975/Anthropic-Cybersecurity-Skills
Detect compromised O365 and Google Workspace email accounts by analyzing Unified Audit Logs and Azure AD sign-in logs for impossible travel, inbox rule creation/deletion (Set-InboxRule…
CLI Microsoft365
pnp/cli-microsoft365-mcp-server
Use CLI for Microsoft 365 to manage Microsoft 365 tenants from the terminal.
CLI Microsoft365 Script
pnp/cli-microsoft365-mcp-server
Write PowerShell scripts using CLI for Microsoft 365 commands to automate Microsoft 365 management tasks.
Detecting Azure Service Principal Abuse
mukul975/Anthropic-Cybersecurity-Skills
Detect Azure service principal abuse in Microsoft Entra ID using KQL detection queries (Sentinel/Splunk) against Azure AD Audit and Sign-in Logs, covering added credentials, privileged role…
More from vinayaklatthe/microsoft-security-skills
All 50 skills in this repoAPI Security Design
vinayaklatthe/microsoft-security-skills
Guidance for designing secure APIs on Azure - authentication, authorization, gateway controls, input validation, rate limiting, secret management, and runtime threat detection - aligned to OWASP API…
Azure App Service Security
vinayaklatthe/microsoft-security-skills
Guidance for securing Azure App Service web apps and APIs — managed identity, Easy Auth with Microsoft Entra ID, network isolation via private endpoints + VNet integration, HTTPS / TLS hardening…
Azure Arc
vinayaklatthe/microsoft-security-skills
Guidance for Azure Arc — projecting on-premises, multicloud (AWS/GCP), and edge servers, Kubernetes, and data services into Azure Resource Manager for unified governance, security, and management.
Azure Bastion Jit
vinayaklatthe/microsoft-security-skills
Guidance for secure remote VM management in Azure using Azure Bastion combined with Defender for Cloud just-in-time (JIT) VM access.
Azure Confidential Computing
vinayaklatthe/microsoft-security-skills
Guidance for Azure Confidential Computing — protecting data in use through hardware-based Trusted Execution Environments (TEEs).
Azure Ddos Protection
vinayaklatthe/microsoft-security-skills
Guidance for Azure DDoS Protection — Network Protection (per-VNet) and IP Protection (per public IP) tiers built on the same always-on Microsoft platform.
Related
Categories
Questions about Defender Xdr
What does Defender Xdr do?
Guidance for Microsoft Defender XDR — the unified extended detection and response suite that correlates signals across endpoints, identities, email, and cloud apps into prioritised incidents with…. Defender Xdr is an agent skill from vinayaklatthe/microsoft-security-skills. Guidance for Microsoft Defender XDR — the unified extended detection and response suite that correlates signals across endpoints, identities, email, and cloud apps into prioritised incidents with attack-graph context.
When should I use Defender Xdr?
Defender Xdr fits situations like: the need is SIEM log ingestion; custom KQL detections from third-party sources (use sentinel); merging Sentinel into the Defender portal (use unified-secops-platform); endpoint-only EDR (use defender-for-endpoint).
How do I install Defender Xdr in Claude Code?
Run `npx skills add vinayaklatthe/microsoft-security-skills --skill defender-xdr -a claude-code`. Or copy the skill folder (skills/defender-xdr in vinayaklatthe/microsoft-security-skills) into .claude/skills/defender-xdr in your project. Claude Code loads it when a task matches its description.
How do I install Defender Xdr in Codex?
Run `npx skills add vinayaklatthe/microsoft-security-skills --skill defender-xdr -a codex`. Or copy the skill folder (skills/defender-xdr in vinayaklatthe/microsoft-security-skills) into .agents/skills/defender-xdr in your project. Codex loads it when a task matches its description.
Can I use Defender Xdr in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add vinayaklatthe/microsoft-security-skills --skill defender-xdr -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/defender-xdr, .gemini/skills/defender-xdr, .github/skills/defender-xdr and .opencode/skills/defender-xdr in your project.
What does Defender Xdr need to run?
SKILL.md names no scripts, command-line tools or credentials: Defender Xdr is instructions for the agent only.
Does Defender Xdr access the network?
SKILL.md names 1 domain. As links in the text: learn.microsoft.com. This is read from the text; nothing was executed.
Is Defender Xdr safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Defender Xdr use?
Defender Xdr is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Defender Xdr use?
About 2.1k tokens (SKILL.md is roughly 8.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Defender Xdr?
Skills that share tags, products or a category with Defender Xdr: Investigating M365 Entra (trilwu/secskills, 157 stars), Sap Btp Build Work Zone Advanced (secondsky/sap-skills, 462 stars), Detecting Email Account Compromise (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and CLI Microsoft365 (pnp/cli-microsoft365-mcp-server, 132 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Defender Xdr?
vinayaklatthe (a GitHub user) maintains it in vinayaklatthe/microsoft-security-skills, which has 175 GitHub stars. The repository holds 50 skills in this directory. The repository was last updated on June 18, 2026.
Source: vinayaklatthe/microsoft-security-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.