Microsoft Copilot security directory

Microsoft Defender ATP

Published by Microsoft

High risk

Microsoft Defender ATP is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Read more about it here: http://aka.ms/wdatp

Security assessment

Plutonium assessed this connector for permissions, capabilities, and security-relevant behavior.

  • Reads your private information: This connector can read data the connected service holds about you - documents, messages, contact lists, source code, customer records, or saved profile details - and pass it back to the AI.
  • Can change or update your information: This connector can edit, rename, overwrite, or otherwise modify records in the connected service. If a request gets manipulated, your data could be altered without you noticing.
  • Can permanently delete data: This connector can erase records, files, or accounts. Once deleted the data may be unrecoverable - even an accidental request can cause permanent loss.
  • Can execute code or queries: This connector can run arbitrary queries or code against a database or execution engine. An AI-generated query could be manipulated to exfiltrate, corrupt, or destroy data.

Available capabilities

This add-on exposes 29 tools or capabilities.

  • Actions - Cancel a single machine action
  • Actions - Collect investigation package
  • Actions - Get investigation package download URI
  • Actions - Get list of investigation
  • Actions - Get list of machine actions
  • Actions - Get live response command result download URI
  • Actions - Get single investigation
  • Actions - Get single machine action
  • Actions - Initiate investigation on a machine (to be deprecated)
  • Actions - Isolate machine
  • Actions - Remove app execution restriction
  • Actions - Restrict app execution
  • Actions - Run antivirus scan
  • Actions - Run live response
  • Actions - Start automated investigation on a machine (Preview)
  • Actions - Unisolate machine
  • Advanced Hunting (Deprecated)
  • Alerts - Create alert
  • Alerts - Get list of alerts
  • Alerts - Get single alert
  • Alerts - Update alert
  • Domains - Get the statistics for the given domain name
  • Files - Get the statistics for the given file
  • Ips - Get the statistics for the given ip address

The interactive security report will load automatically.