Agent skill · security · aradotso
security-investigator-automation
Automated security investigations using Microsoft Sentinel, Defender XDR, GitHub Copilot Agent Skills, and MCP servers for natural language threat hunting
Why this skill is useful
Adds 25 specialized investigation workflows with KQL queries and automated report generation that enhance security investigation capabilities.
What it needs
Requires git, python installed locally. Requires abuseipdb, azure, ipinfo, shodan, vpnapi account access. About 8k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
security-investigator-automation Skill by ara.so — Security Skills collection. Automated security investigation framework combining GitHub Copilot Agent Skills, VS Code, and Model Context Protocol (MCP) servers to enable natural language security investigations across Microsoft Sentinel, Defender XDR, Graph API, and threat intelligence platforms. Includes 25 specialized investigation workflows with KQL queries, threat intelligence enrichment, and automated HTML report generation. Installation Configuration 1. Sentinel and Azure Configuration Edit config.json: 2. Threat Intelligence API Keys Edit .env: 3. MCP Server Configuration The template includes pre-configured MCP servers: @sentinel-datalake - Sentinel log analytics @sentinel-triage - Defender XDR Advanced Hunting @graph-api - Entra ID/Graph API queries @kql-search - Schema documentation @microsoft-learn - Documentation reference @azure-mcp-server - Azure Resource Manager + Monitor @sentinel-graph - Relationship mapping (private preview) Custom local MCP apps (geomap, heatmap, incident-comment) are also pre-configured. Core Workflow 1. Start Investigation with Copilot Chat Open VS Code Copilot Chat (Ctrl+Shift+I) in Agent mode. Recommended first command: This executes the threat-pulse skill which scans 9 security domains and provides prioritized findings with drill-down recommendations. 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/security-investigator-automation