kql-mde-xdr

Features and purpose

Expert in Kusto Query Language (KQL) and Microsoft Defender for Endpoint (MDE) / Microsoft 365 Defender XDR. Use when working with KQL queries, threat hunting, security investigations, writing detection rules, analyzing security data in Microsoft Sentinel, MDE, or any Microsoft XDR platform. Triggers on KQL syntax questions, threat hunting queries, detection engineering, incident investigation, or security analytics using Microsoft security tools.

Quick start

Follow the repository instructions for this skill and your agent. Review the files and dependencies before adding it to your workflow.