Translates user requests into transparent KQL and executes bounded, read-only Defender XDR queries through a direct OAuth/OBO API, then produces reproducible evidence packages and analyst review without response execution.
Install
- 1Add it in ChatGPT
Open Plugins in the ChatGPT sidebar (web or desktop), search for “Aivana Security Investigator” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.
Skills 3
- analyst-review
Use when preparing or reviewing a reproducible security evidence package.
- investigation
Use when starting or governing an evidence-backed Microsoft security investigation.
- xdr-hunting
Use when translating user intent into bounded, validated Microsoft Defender XDR KQL and running it through the direct API.
Things to ask
- “Translate this investigation question to KQL and run it safely.”
- “Validate this Defender XDR KQL before running it.”
- “Prepare an evidence package for analyst review.”