Translates user requests into transparent KQL and executes bounded, read-only Defender XDR queries through a direct OAuth/OBO API, then produces reproducible evidence packages and analyst review without response execution.
Skills
analyst-review
investigation
xdr-hunting
Information
Funktioner
Direct OAuth/OBO Defender XDR KQL API, Read-only cross-domain investigations, Evidence packages and analyst review