Security
Microsoft Defender
EDR — alerts, machines, vulnerability exposure, investigations, and live response actions.
Command it in chat
Ask the Orbit Assistant about your Microsoft Defender data in plain English — it plans the API calls and answers clearly, not with raw JSON.
Automate it with skills
Put Microsoft Defender inside autonomous skills and playbooks that run on schedules, webhooks, or events — and chain it with your other tools.
Governed by default
Set action policies and member access, require approvals where needed, and review recorded activity. Supported autonomy modes depend on your plan.
17 built-in actions
Explore fictional results in workspace Simulated mode before connecting credentials. Real actions follow workspace approval policies; validate the actions you need with your own account.
List Alerts
list_alerts
Get Alert
get_alert
Update Alert
update_alert
List Machines
list_machines
Get Machine
get_machine
Isolate Machine
isolate_machine
Release Machine from Isolation
release_machine
Run Antivirus Scan
run_antivirus_scan
Stop and Quarantine File
stop_and_quarantine_file
Collect Investigation Package
collect_investigation_package
List Machine Vulnerabilities
list_machine_vulnerabilities
List All Vulnerabilities
list_vulnerabilities
List Software Inventory
list_software
List Investigations
list_investigations
List Custom Indicators
list_indicators
Create Custom Indicator
create_indicator
Get Machine Alerts
get_machine_alerts
Explore before you connect
Explore Microsoft Defender in a workspace with fictional sample data before adding credentials. Workspace simulations may use AI Power; signup may require a beta invite.
Explore in a workspace