Skip to content
xdr-cli
LESS CLICKING. MORE INVESTIGATING.

Turn your coding agent
into a security analyst.

Give the coding agent you already use access to Microsoft Defender XDR incidents and advanced hunting. xdr-cli brings the investigation playbooks and evidence. Your agent brings the questions.

Put the coding-agent subscription you already have to work on incident triage.

Start investigating Set up your agent
INSTALL WITH PIPXPython 3.11+
pipx install "git+https://github.com/NerfBlasters/m365-xdr-cli.git"
Defender data. Agent curiosity.xdr
YOU

Do we have any North Koreans working for us?

THINKING

I’ll look for DPRK IT-worker tradecraft: unexpected remote-access tools, VPN/proxy use, and laptop-farm sign-in patterns. Start with remote-access tooling, then correlate the accounts and sign-ins.

HUNT / FIRST PASS$ xdr hunt run "DeviceProcessEvents | where Timestamp > ago(7d) | where FileName in~ ('AnyDesk.exe', 'rustdesk.exe') | summarize Runs=count() by DeviceName, AccountUpn | top 50 by Runs desc"
Remote-access tooling is a lead, not attribution.
Illustrative prompt and first hunt · Microsoft’s IT-worker threat research ↗
Defender permissions apply Local JSONL evidence Works with AI assistantsMIT licensed
EXAMPLE PROMPT

Read AGENTS.md, then investigate incident 42. Summarize the evidence and flag anything that needs my review.

Use an incident ID from your tenant.
AGENT-DRIVEN INVESTIGATIONS

Your coding agent can investigate incidents (and it’s surprisingly good at it)

Point your agent at AGENTS.md and ask it to investigate an incident. The instructions cover how to gather evidence, choose hunts, and report what it found. You review its conclusions and decide on response actions.

xdr-cli saves large results locally as .jsonl—one complete JSON record per line—and returns a compact receipt. Your agent can grep for relevant rows, then parse them with jq, awk, sed, or whatever it already knows. Its context window can breathe again.

If your harness hooks allow xdr but restrict other shell tools, xdr results rows reads the saved data through that same CLI, with no extra tools to configure. Each result has rich metadata: the producing command, exact KQL for hunts, resolved library parameters, timestamps, row counts, and integrity hashes.

Set up your assistant
WATCH AN INVESTIGATION

Two views of an agent at work

Recorded in GitHub Copilot using xdr-cli. Standard and verbose are Copilot harness display settings; xdr-cli is the same in both. Names, hostnames, and other selected identifiers have been replaced with aliases.

https://thehackernews.com/2026/10/clickfix-smuggles-payloads-through.html

Read this article on the latest clickfix variant, extract the IOCs and tactics, and then hunt in my tenant using xdr-cli for any instances of it.

Two runs of the same hunt, with slightly different prompt wording. Use fullscreen to read the terminal detail.

Standard output

2m 33s

The agent’s thinking and compact tool output.

Verbose output

3m 27s

More of the commands, queries, and returned evidence.

GUIDES & REFERENCE

RTFM

Read the fu....n.. manual

All documentation
01

Installation and setup

Install xdr-cli and connect it to your Defender tenant.

02

Query library

Find a hunting query and check which parameters it needs.

03

Investigation playbooks

Look up an alert title for investigation steps and common false positives.

04

AI assistants

Set up an agent to use xdr-cli and read its results.

05

Investigation guide

Gather evidence, build a timeline, and decide which questions to hunt next.

06

Result files

Read JSONL evidence, inspect metadata, and reuse the exact query behind a result.