What this tenant exposes, as a ZeroSOC capability binding. Call it once before investigating. It checks which hunting tables hold data, which are exposed but empty and which the licence does not expose at all, which APIs answer, and which application permissions are granted, so an empty query result is read correctly: a visibility gap, a missing licence or a missing permission. Returns capabilities (capability class to tool), data_sources (each playbook data source, available or not, with the reason in data_source_notes) and probe (every check, the granted roles, the classes left unbound and the checks that stay manual). The probe only reads; the result is kept until refresh.

Decode a PowerShell -EncodedCommand payload (base64 of UTF-16LE) exactly. Accepts the full command line, any spelling of the flag (-e, -enc, -ec, ...), or the bare base64. Use it instead of decoding by hand. A decoding that is itself an encoded command is decoded again, up to five rounds: rounds is how many layers were removed and capped says the command was still encoded when they ran out. The evidence inventory already carries decoded_command, decode_rounds and decode_capped on process rows.

Convert a timestamp to UTC exactly. The APIs return UTC; the Defender portal shows the viewer's local time. Convert every time quoted from the portal or by a person before it goes into a timeline, so all entries share one reference.

Get the organization's exposure score: lower is better.

Get the Microsoft Secure Score for Devices: higher is better.

Get the exposure score of each device group.

List the antivirus health of devices: mode, engine, platform and signature versions and their freshness, last quick and full scan. A device whose antivirus is passive, disabled or out of date explains a missing detection.

Get the short-lived download links of the full antivirus health report of every device. For a bounded look at it use defender_get_device_health.

List the vulnerabilities that affect the organization, e.g. filter "severity eq 'Critical'" or "publicExploit eq true".

Get one vulnerability by CVE ID: severity, CVSS, exploit availability, exposed devices.

List the vulnerabilities that affect one device.

List the devices exposed to a vulnerability.

List the software inventory of the organization with weaknesses and exposed devices.

Get one software entry: vendor, weaknesses, exploit availability, exposed devices.

List the vulnerabilities of one software entry.

List the devices that have a software installed.

Get the distribution of installed versions of a software.

List security recommendations, e.g. filter "remediationType eq 'ConfigurationChange'".

Get one security recommendation.

List the devices a security recommendation applies to.

List the vulnerabilities a security recommendation addresses.

List remediation activities with their status and due date.

Get one remediation activity.

List the devices still exposed under a remediation activity.

Read a per-device assessment: one row per device and software, vulnerability, configuration or browser extension. The full export is large; this returns one bounded page and the next link.

List response actions taken on devices (isolation, release, scans, quarantine, packages, live response) with their status, requestor, comment and times, e.g. filter "machineId eq ''" or "type eq 'Isolate'". It lists actions taken by anyone, people included, so it is how to check whether a containment still stands.

Get one machine action: type, status (Pending, InProgress, Succeeded, Failed, TimeOut, Cancelled), requestor, comment and times. Poll it after a response action.

Get the short-lived download link of a collected investigation package. The link grants access to forensic data: hand it to a person, do not store it in a note.

Get the short-lived download link of the output of one live response command.

List automated investigations with their state and the alert that triggered each.

Get one automated investigation: state, status details, device and triggering alert.

List the scripts in the live response library.

List the custom indicators (allow, audit, warn, block) of the tenant, with OData filtering, e.g. "indicatorValue eq '203.0.113.7'", "action eq 'Block'".

Get what Defender knows about a file by hash: global prevalence and first seen, size, type, signer and issuer, determination. Only the hash leaves the environment.

Get the prevalence of a file in this organization and worldwide, with first and last seen. A file seen on one device and nowhere else is worth a closer look.

List the Defender for Endpoint alerts that involve a file.

List the devices a file was seen on: the lateral scope of a hash.

List the Defender for Endpoint alerts that involve a domain.

List the devices that communicated with a domain: the lateral scope of a domain.

Get the prevalence of a domain in this organization, with first and last seen.

List the Defender for Endpoint alerts that involve an IP address.

Get the prevalence of an IP address in this organization, with first and last seen.

List the Defender for Endpoint alerts that involve a user.

List the devices a user logged on to: logon relationships, not role or privilege.

List devices onboarded to Defender for Endpoint, with OData filtering, e.g. "healthStatus eq 'Active'", "riskScore eq 'High'", "startswith(computerDnsName,'ws')".

Get one device: DNS name, OS, health, risk and exposure level, tags, device value, IPs, first and last seen. Accepts the machine ID (the mdeDeviceId of alert evidence).

Find the devices that had an IP address around a given time.

Find the devices that carry a tag.

List the users that logged on to a device.

List the Defender for Endpoint alerts of one device.

Update a device's tags or device value (a metadata write).

Add a tag to a device or remove one (a metadata write).

List interactive sign-ins from the Entra ID sign-in log: user, application, client and IP address, location, device, conditional access result, MFA detail, risk and error code. Always filter, e.g. "userPrincipalName eq 'alice@contoso.com' and createdDateTime ge 2026-01-01T00:00:00Z", "ipAddress eq '203.0.113.7'", "status/errorCode ne 0". Timestamps are UTC. Requires an Entra ID P1 or P2 licence in the tenant; retention is 30 days.

List Entra ID directory audit events: changes to users, groups, roles, applications, service principals, credentials and policies, with who made them. Always filter, e.g. "activityDisplayName eq 'Add member to role'", "initiatedBy/user/userPrincipalName eq 'alice@contoso.com'", "activityDateTime ge 2026-01-01T00:00:00Z", "targetResources/any(t: t/id eq '')". Timestamps are UTC.

Run an advanced hunting query (KQL) across Defender XDR data: endpoint, identity, email and cloud apps in one query. Tables include AlertInfo, AlertEvidence, DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents, DeviceRegistryEvents, DeviceLogonEvents, DeviceEvents, IdentityLogonEvents, IdentityDirectoryEvents, EmailEvents, EmailUrlInfo, UrlClickEvents and CloudAppEvents. Which tables hold data depends on the tenant's licences: an empty result from a table that defender_get_capabilities reports as empty or not exposed is a visibility gap, not a finding and not a permissions problem. The sensor records no creation event for some processes (services started before it, some short-lived instances): a process absent from DeviceProcessEvents may still be there as the InitiatingProcessId and InitiatingProcessCreationTime of other events, so look there before concluding it did not run. Match a process by PID together with its creation time, never by PID alone. Timestamps are UTC. Data is limited to the last 30 days. Example: "DeviceProcessEvents | where Timestamp > ago(1d) | where FileName =~ 'powershell.exe' | project Timestamp, DeviceName, ProcessCommandLine | limit 50".

List alerts from all Defender XDR workloads: Endpoint, Office 365 email, Identity, Cloud Apps and Entra ID Protection. Supports OData filtering with Graph camelCase values, e.g. "severity eq 'high'", "status eq 'new'", "serviceSource eq 'microsoftDefenderForEndpoint'", "createdDateTime gt 2026-01-01T00:00:00Z". Each alert carries its evidence inline. For the alerts of one incident use defender_get_incident_alerts.

Get one alert with its full evidence (files, processes, registry keys, IPs, URLs, users, mailboxes, devices), MITRE techniques, detection source, detector ID and comment thread.

Update an alert (a triage write): status, assignee, classification and determination.

Append a comment to an alert's comment thread (a triage write), visible to analysts in the Defender portal. Notes about the whole case belong on the incident instead.

List incidents from Microsoft Defender XDR. Incidents group related alerts from all Defender workloads (endpoint, identity, email, cloud apps) into one attack story. Supports OData filtering with Graph camelCase values, e.g. "status eq 'active'", "severity eq 'high'", "lastUpdateDateTime gt 2026-01-01T00:00:00Z", "assignedTo eq 'analyst@contoso.com'". Use it to find incidents before drilling into one. A merged incident has status 'redirected' and names its master in redirectIncidentId.

Get one incident as it is stored: severity, status, classification, determination, owner, custom tags, comment thread, timestamps, and redirectIncidentId when it was merged into another. The starting point of incident analysis; it does not follow merges (use defender_resolve_incident for that).

Follow the merge history of an incident to its master. Returns the master incident with incidentId (the master's ID) and redirectedFrom (the merged IDs walked, in order; empty when the incident is live). Writes made by this server already do this; call it to learn where an incident went.

Get the alerts of an incident, paged (skip/top), with their details: title, severity, category, MITRE techniques, detection source, timestamps and nested evidence. For the entities themselves prefer defender_get_incident_evidence, which flattens and de-duplicates the evidence of every alert in one call.

The full evidence inventory of an incident: the portal's evidence view as one table. Pages through every alert and flattens the evidence into one row per evidence item, each joined to its device (by device ID, else through the alert) and listing the alerts that cite it. A row is the source's own unit: entityCount equals the portal's count of evidence items and is the number to reconcile; rowCount is the number of per-alert evidence rows. The source lists one process more than once when alerts describe it differently (no image file, another path, a different verdict): those rows share instance (device, PID, creation time), sameProcess groups them with their verdicts, and processInstanceCount is the number of real processes. Rows carry type, name, PID and parent PID, full command line and its decoded -EncodedCommand payload, creation times in UTC, SHA1/SHA256, path, user SID and UPN, device ID, IP, registry key and value, detailed roles, verdict and remediation status. Follows a merged incident to its master. These are the entities the alerts cite, not raw telemetry: processes the detection did not flag are not here.

Update an incident (a triage write): status, assignee, classification, determination and custom tags. If the incident was merged into another, the update is applied to the master incident and redirectedFrom says so.

Append a comment to an incident's comment thread (a triage write), visible to analysts in the Defender portal. If the incident was merged into another, the comment is written on the master incident, where analysts will read it, and redirectedFrom says so.