I have worked in IT for about 20 years. A lot of that was MSP operations. Today I work as an M365 cloud admin.

I kept writing the same scripts. So I cleaned them up and shared them on GitHub. This toolkit is for Microsoft Defender XDR. It uses PowerShell 7 and the Microsoft Graph security API, including runHuntingQuery .

Repo: defender-xdr-powershell-toolkit

The problem it solves

The Defender portal is great for one incident. It is less great for reports, trends or running the same hunt every week.

You also want to know which devices are not onboarded to Defender for Endpoint. Gaps there are blind spots.

These scripts pull that data to CSV so you can track it.

Highlight scripts

Invoke-AdvancedHuntingQuery.ps1

Runs an advanced hunting KQL query and exports the results. The repo has a small KQL library, like encoded PowerShell, password spray and new forwarding rules.

. / Invoke - AdvancedHuntingQuery . ps1 - QueryFile . . / . . / hunting / queries / encoded - powershell . kql .…