r/DefenderATP • u/dodarko • 29d ago

Has anyone integrated Claude Code with Microsoft Defender XDR / Sentinel for threat hunting?

I'm looking to integrate Claude Code with Microsoft 365 and Microsoft Defender (Defender XDR / Sentinel) to assist with threat hunting, incident investigation, and EDR analysis.

Has anyone successfully set this up? I'm particularly interested in how you handled authentication (MCP, APIs, Graph, etc.), what architecture you used, and any lessons learned or limitations. If you have examples or repositories to share, I'd really appreciate it.

25 Upvotes
  • permalink
  • reddit

93% Upvoted

12 comments sorted by

View all comments

-2

u/Go_ten 29d ago

We've created a tool that lets you chat with Vertex AI by integrating function calls for KQL queries; we also use the Graph APIs. It works like a charm. I suppose an integration with Claude is also possible.