Translates user requests into transparent KQL and executes bounded, read-only Defender XDR queries through a direct OAuth/OBO API, then produces reproducible evidence packages and analyst review without response execution.
Install
- 1Add it in ChatGPT
Open Plugins in the ChatGPT sidebar (web or desktop), search for “Aivana Security Investigator” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.
Skills 3
- analyst-review
Use when preparing or reviewing a reproducible security evidence package.
- investigation
Use when starting or governing an evidence-backed Microsoft security investigation.
- xdr-hunting
Use when translating user intent into bounded, validated Microsoft Defender XDR KQL and running it through the direct API.
Things to ask
- “Translate this investigation question to KQL and run it safely.”
- “Validate this Defender XDR KQL before running it.”
- “Prepare an evidence package for analyst review.”
Disconnect or uninstall
- 1In ChatGPT
Disconnect an account in Settings → Apps or Plugins. To remove the plugin itself, open Aivana Security Investigator in the Plugin Directory and select Uninstall plugin. Uninstalling can disconnect every account connected through it, and plugins your workspace installs may not offer the option.
- 2In Codex
Run /plugins in the Codex CLI, select the plugin and uninstall it, or press Space to turn it off.