Computer Security Investigation - Instructions

Purpose

This skill performs comprehensive security investigations on Windows, macOS, and Linux devices registered in Microsoft Entra ID and/or managed by Microsoft Defender for Endpoint. It analyzes Defender alerts, device compliance, sign-in patterns, logged-on users, installed software, vulnerabilities, network connections, and automated investigation results for:

• Entra Joined Devices: Cloud-only devices joined directly to Microsoft Entra ID
• Hybrid Joined Devices: Devices joined to both on-premises Active Directory and Microsoft Entra ID
• Entra Registered Devices: Personal devices (BYOD) registered with Microsoft Entra ID

📑 TABLE OF CONTENTS