mcpField
D
defender-tvm

defender-tvm

github.com/vinayaklattheSecurity17845 installsUpdated 19w ago
Repository

About defender-tvm

A security skill for teams using Microsoft Defender Vulnerability Management and Defender TI to manage endpoint exposure and threat intelligence. It covers remediation prioritization, intelligence pivots, and operational guardrails.

Key features

  1. 01Prioritize vulnerabilities by exposure and threat context
  2. 02Assess security baselines and endpoint inventory
  3. 03Pivot from indicators to related infrastructure
  4. 04Enrich threat hunting and SIEM investigations
  5. 05Plan remediation and intelligence workflows

Use cases

  1. 01Rank endpoint patch work by active threat
  2. 02Review CIS or STIG baseline drift
  3. 03Investigate infrastructure linked to a suspicious indicator
  4. 04Enrich Sentinel alerts with threat intelligence

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/vinayaklatthe/microsoft-security-skills --skill defender-tvm

After installing, type/defender-tvmin Claude Code to confirm it loaded.

Details

From the project README

Microsoft Defender TI & Vulnerability Management

This skill covers two complementary capabilities:

  • Microsoft Defender Vulnerability Management (MDVM) — risk-based vulnerability management for endpoints (Windows, macOS, Linux, mobile), firmware, browser extensions, certificates, and security baselines.
  • Microsoft Defender Threat Intelligence (Defender TI / MDTI) — Microsoft's finished-intel and raw-IOC product for adversary tracking, infrastructure pivoting, and threat hunting enrichment.

Both feed Defender XDR and Sentinel.

When to use

  • Prioritizing patching/remediation across a large endpoint estate.
  • Measuring exposure score and security baseline drift.
  • Hunting and responding to threats with adversary intel and infrastructure data.
  • Enriching SIEM alerts with intel profiles and indicator context.

Do not use this skill for endpoint policy/onboarding (defender-for-endpoint), SIEM detection rules (sentinel-detection-engineering), or outside-in attack surface (defender-easm).

MDVM — what's in core MDE Plan 2 vs the add-on

CapabilityMDE Plan 2MDVM Add-on
CVE-based vulnerability inventory✅✅
Exposure score, recommendations✅✅
Threat-aware prioritization✅✅
Security baselines assessment (CIS, STIG)—✅
Browser extension inventory—✅
Digital certificate inventory—✅
Network share configuration assessment—✅
Hardware & firmware inventory—✅
Block vulnerable applications—✅
Authenticated scan for unmanaged Windows—✅

Rule of thumb: If you're already on MDE P2 and your audit team asks for CIS-aligned evidence, you need the MDVM add-on.

Approach

MDVM workflow

  1. Triage by exposure score, not CVE count. Exposure score weights exploitability + asset criticality + active threat campaigns. A 5,000-CVE backlog sorted by exposure becomes a 50-task action list.

  2. Use threat insights filters. Microsoft tags CVEs with: Public Exploit, Verified by Microsoft, Active Threat Campaign, Exploit Available in Kit. Patch Active Threat Campaign first, regardless of CVSS.

  3. Wire remediation to Intune. "Create remediation request" pushes a task to Intune admin queue with the affected device list — the patch lifecycle stays in one place.

  4. Security baselines (Plan 2 add-on). Pick CIS or STIG, scope to a device group, review compliance per setting, prioritize the security-impacting settings.

  5. Block vulnerable apps (add-on). Use sparingly: blocks Adobe Reader 21.x, Chrome <120, etc. across the estate. Pilot on a small group; some users have legitimate version pins.

  6. Cadence. Weekly review of top-10 exposure-reducing actions; monthly executive exposure-score trend; quarterly baseline drift report.

Defender TI workflow

  1. Intel profiles — track named adversaries (e.g., Storm-####), threat tools, CVEs, campaigns. Subscribe relevant ones; updates surface in Defender XDR.

  2. Infrastructure pivoting. Given an indicator (IP, domain, hash), Defender TI shows pDNS, WHOIS history, certificate associations, related infrastructure — pivot to find adversary infrastructure your SIEM hasn't seen yet.

  3. Bring intel into hunting.

    • Defender XDR advanced hunting: indicators are first-class joinable entities.
    • Sentinel: connect MDTI via the Threat Intelligence Premium data connector; ThreatIntelligenceIndicator and articles populate.

  4. MDTI API for automation. Pull articles/indicators into a SOAR playbook for auto-enrichment of incidents.

  5. Free vs Premium. Defender TI portal has a free tier (limited articles, pivots/day); Premium unlocks unlimited pivots, full intel-profile catalogue, and API throughput. Most enterprise SOC use needs Premium.

Guardrails

  • Don't drown in CVE counts. Exposure score + threat insight is the actionable view. Counting CVEs is a vanity metric.
  • MDVM remediation needs an owner. Surfacing 200 recommendations in a dashboard with no Intune integration / patch owner produces no patches.
  • Block-vulnerable-apps is invasive. Pilot. Communicate. Some apps must be pinned for business reasons.
  • Security baselines are a journey. 100% CIS compliance is rarely achievable or desirable; pick the security-impacting subset.
  • Intel without context is noise. Don't ingest every MDTI indicator into a Sentinel watchlist as a "match-and-alert" — match-rate × low fidelity = alert fatigue.
  • Confirm licensing. MDTI Premium and the MDVM add-on are separately licensed; customers often think they're included in M365 E5 — they aren't.
  • Scan results lag by hours; don't expect minute-by-minute vuln status.

Common anti-patterns

  • "Patched 1,000 medium CVEs while a critical exploited CVE sat for 60 days" — sort by threat campaign, not CVSS bucket.
  • "Bought MDVM add-on for the exposure score we already had in MDE P2" — overlap. Map features before buying.
  • "All MDTI indicators auto-blocked at the firewall" — false-positive blast. Pivot/validate first.
  • "Security baseline 'Compliance' score treated as security score" — they're not the same; many baseline settings are operational hardening, some are not security-critical.
  • "Intel profile subscriptions = no triage" — articles need analyst triage to translate to detections/blocks.
  • "Authenticated scan on every unmanaged Windows host without scoping" — generates service-account auth events at scale; coordinate with identity team.

Example prompts

  • Top 10 actions to reduce our exposure score by 20% this quarter.
  • Patch prioritization runbook: how to use threat insights to triage 8,000 open CVEs.
  • Roll out CIS Windows baseline assessment across 30,000 endpoints.
  • Wire MDVM remediation requests to Intune and an ITSM ticket queue.
  • Pivot from a suspicious domain to related adversary infrastructure using MDTI.
  • Connect MDTI Premium to Sentinel and build a hunting workbook.
  • Pilot block-vulnerable-apps for outdated Java runtimes on dev machines.
  • Build a quarterly executive exposure-score and intel-profile briefing.

Microsoft Learn

Comments

Markdown supported