Mcp Msdefenderkql

Runs KQL queries against Microsoft Defender Advanced Hunting, letting an assistant turn natural-language questions into hunting queries.

What you can do

• Translate natural-language requests into KQL and run them against Microsoft Defender Advanced Hunting.
• Return hunting query results for the assistant to interpret and summarize.
• No individual tools are documented in the supplied listing, so exact operations are unconfirmed.

When to use it

Useful when you investigate security events in Microsoft Defender and want an assistant to draft and execute Advanced Hunting queries without writing KQL by hand.

Requirements

Runs locally as a Python (PyPI) package over stdio, so a Python environment is needed. The listing declares no authentication, environment variables or headers, yet access to Microsoft Defender Advanced Hunting normally requires tenant credentials; expect to supply them yourself.