skill CX Codex

security-investigator-automation — Claude Code skill for Microsoft Sentinel investigations

Q: How do I install security-investigator-automation in Claude Code?

Run `npx skills add reason-machines/security-skills --skill security-investigator-automation -a claude-code`. The skill lands at `~/.claude/skills/security-investigator-automation/SKILL.md`.

Q: What has to be in place before the first run?

Fill `config.json` with your Sentinel and Azure identifiers, put IPInfo, AbuseIPDB, vpnapi.io and Shodan keys in `.env`, and build `.vscode/mcp.json` from the template.

A skill that runs security investigations across Microsoft Sentinel, Defender XDR and Graph API from a plain-language request.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓

npx skills add reason-machines/security-skills --skill security-investigator-automation -a claude-code

Open on GitHub

What security-investigator-automation does

This skill drives investigations through the Microsoft security stack: Sentinel, Defender XDR, Graph API and threat intelligence services. It ships 25 workflows with KQL queries, indicator enrichment and HTML report generation. The main surface is VS Code Copilot Chat in Agent mode; the skill also installs into Claude, Codex, Cursor, Gemini CLI and OpenCode.

Setup goes through three templates. config.json.template holds your Sentinel workspace and Azure tenant identifiers, .env.template holds keys for IPInfo, AbuseIPDB, vpnapi.io and Shodan, and .vscode/mcp.json.template wires the MCP servers: @sentinel-datalake, @sentinel-triage, @graph-api, @kql-search, @microsoft-learn, @azure-mcp-server and @sentinel-graph in private preview. Skip the threat intelligence keys and enrichment quietly degrades.

The suggested first prompt is a threat pulse scan, which sweeps 9 security domains and returns findings by priority. After that the skill picks a workflow from keywords: user, incident, indicator, device, authentication, Conditional Access, behavioural drift. Baseline-dependent workflows such as device or service principal scope drift need history to compare against, so a fresh tenant gives thin results on day one.

What it helps with

check a user across sign-in logs and Identity Protection alerts
break down an incident with a criticality rating and MITRE ATT&CK mapping
score an IP against several threat intelligence sources
spot drift in device or service principal behaviour
produce an HTML report from an investigation

Example prompts for the agent

Run a threat pulse scan and show me what needs attention
Analyze incident 12345 and map the entities to MITRE ATT&CK
Is this IP malicious? 203.0.113.42

How to install security-investigator-automation

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill security-investigator-automation -a claude-code

2Manually: put the files in place

~/.claude/skills/security-investigator-automation/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/security-investigator-automation/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill security-investigator-automation -a codex

2Manually: put the files in place

.agents/skills/security-investigator-automation/SKILL.md

For all projects use ~/.agents/skills/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill security-investigator-automation -a cursor

2Manually: put the files in place

.cursor/skills/security-investigator-automation/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install reason-machines/security-skills security-investigator-automation

2Manually: put the files in place

.github/skills/security-investigator-automation/SKILL.md

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill security-investigator-automation -a gemini-cli

2Platform CLI

gemini skills install https://github.com/reason-machines/security-skills --path skills/security-investigator-automation

Manually: put the files in place

.devin/skills/security-investigator-automation/SKILL.md

The legacy .windsurf/skills/ path still works

Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill security-investigator-automation -a opencode

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about security-investigator-automation

How do I install security-investigator-automation in Claude Code?

Run npx skills add reason-machines/security-skills --skill security-investigator-automation -a claude-code. The skill lands at ~/.claude/skills/security-investigator-automation/SKILL.md.

What does security-investigator-automation do?

It runs security investigations across Microsoft Sentinel, Defender XDR and Graph API from natural-language prompts. It pulls the data, enriches indicators from outside sources and writes an HTML report.

What has to be in place before the first run?

Fill config.json with your Sentinel and Azure identifiers, put IPInfo, AbuseIPDB, vpnapi.io and Shodan keys in .env, and build .vscode/mcp.json from the template.

Similar skills

All skills for Security →

git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set42

esaa-security-audit This skill runs 95 checks across 16 security domains and records every finding as an immutable event, so the same repo state yields the same report. CX Codex +1 717installs foundry-security-spec A skill that walks your agent through implementing Cisco's Foundry spec: a multi-role system for finding and validating vulnerabilities. Useful when you're building your own evaluation pipeline. CX Codex +1 683installs web-security-scanner-pro A skill that teaches your agent to drive Web Security Scanner Pro: 49 modules, WAF evasion, CMS checks and HTML or PDF reports. CX Codex +1 607installs pentestcompanion-workspace This skill wires your agent into a self-hosted Pentest Companion workspace for running engagements, tools and reports. CX Codex +1 534installs agentic-security-scanner A skill that scans your code for vulnerabilities, explains findings in plain English and fixes them. Useful when AI writes code faster than you can review it. CX Codex +1 462installs dfyx-code-security-auditor A white-box code audit skill that traces data flows and checks security weaknesses. Use it for release reviews, OWASP checks, or a deeper project assessment. CX Codex +1 334installs linux-pentester-commands A Linux command reference for reconnaissance, enumeration, exploitation, and privilege escalation during authorized penetration testing. CX Codex +1 319installs linux-pentester-command-reference A skill that hands your agent a Linux command reference split by pentest phase: recon, enumeration, exploitation, privesc. CX Codex +1 308installs