Aivana Security InvestigatorTranslate this investigation question to KQL and run it safely.Aivana Security InvestigatorValidate this Defender XDR KQL before running it.Aivana Security InvestigatorPrepare an evidence package for analyst review.

Translates user requests into transparent KQL and executes bounded, read-only Defender XDR queries through a direct OAuth/OBO API, then produces reproducible evidence packages and analyst review without response execution.