# security-investigator-automation

A skill that runs security investigations across Microsoft Sentinel, Defender XDR and Graph API from a plain-language request.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 322 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/security-investigator-automation/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/security-investigator-automation

## What it does

This skill drives investigations through the Microsoft security stack: Sentinel, Defender XDR, Graph API and threat intelligence services. It ships 25 workflows with KQL queries, indicator enrichment and HTML report generation. The main surface is VS Code Copilot Chat in Agent mode; the skill also installs into Claude, Codex, Cursor, Gemini CLI and OpenCode.

Setup goes through three templates. `config.json.template` holds your Sentinel workspace and Azure tenant identifiers, `.env.template` holds keys for IPInfo, AbuseIPDB, vpnapi.io and Shodan, and `.vscode/mcp.json.template` wires the MCP servers: `@sentinel-datalake`, `@sentinel-triage`, `@graph-api`, `@kql-search`, `@microsoft-learn`, `@azure-mcp-server` and `@sentinel-graph` in private preview. Skip the threat intelligence keys and enrichment quietly degrades.

The suggested first prompt is a threat pulse scan, which sweeps 9 security domains and returns findings by priority. After that the skill picks a workflow from keywords: user, incident, indicator, device, authentication, Conditional Access, behavioural drift. Baseline-dependent workflows such as device or service principal scope drift need history to compare against, so a fresh tenant gives thin results on day one.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-investigator-automation -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/security-investigator-automation/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/security-investigator-automation/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-investigator-automation -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/security-investigator-automation/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-investigator-automation -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/security-investigator-automation/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills security-investigator-automation
```

2. **Manually: put the files in place**
- File: `.github/skills/security-investigator-automation/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-investigator-automation -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/security-investigator-automation
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/security-investigator-automation/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-investigator-automation -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/security-investigator-automation/SKILL.md

## When to use it
- check a user across sign-in logs and Identity Protection alerts
- break down an incident with a criticality rating and MITRE ATT&CK mapping
- score an IP against several threat intelligence sources
- spot drift in device or service principal behaviour
- produce an HTML report from an investigation

## Example prompts
- Run a threat pulse scan and show me what needs attention
- Analyze incident 12345 and map the entities to MITRE ATT&CK
- Is this IP malicious? 203.0.113.42

## Similar
- [security-automation](https://affpapa.org/en/nevibecode/skills/security-automation.md) — skill · 354 installs
- [detection-engineering-coverage-evaluation](https://affpapa.org/en/nevibecode/skills/detection-engineering-coverage-evaluation.md) — skill · 6394 installs
- [secops-detection-engineering](https://affpapa.org/en/nevibecode/skills/secops-detection-engineering.md) — skill · 1900 installs
- [osint-recon](https://affpapa.org/en/nevibecode/skills/osint-recon.md) — skill · 386 installs
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816
- [VirusTotal](https://affpapa.org/en/nevibecode/mcp/virustotal-virustotal.md) — MCP server · ★ 24

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 42 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md