Windows Defender module allows you to configure Windows Defender settings.

This module is a collection of functions designed to help you configure and validate your environment for working with Microsoft Defender for Identity.

The Secure Cloud Business Applications (SCuBA) Gear module automates conformance testing about CISA M365 Secure Configuration Baselines.

This module provides the ability to validate the MAPS connection for Microsoft Windows Defender

PowerShell module for converting Defender XDR detection rules between YAML and JSON formats and deploying them in a GitHub CI/CD pipeline.

PowerShell module providing CmdLet for getting human readable information about attack surface reduction rules configured on a Windows Defender client

Various functions related to Microsoft Defender services (APIs). Some of them are explained at https://doitpshway.com. Some of the interesting functions: - Get-M365DefenderMachine - get specific/all machine(s) - Get-M365DefenderMachineUser - get machine owner - Get-M365DefenderMachineVulnerability - get vulnerabilities detecte... More info

PowerShell module for Microsoft Defender for Endpoint (MDE).

This modules was created to help manually configure the local ASR settings of a machine in a small scale scenario where doesn't make sence to use System Center Configuration Manager, Microsoft Intune or Group Policies to deploy the settings.

Comprehensive read-only Microsoft 365 security assessment tool for IT consultants and administrators. Covers Entra ID, Exchange Online, Intune, Defender, SharePoint, Teams, Purview, and Active Directory.

Implements the defender API

The unofficial API cmdlet to interact with the Microsoft Defender XDR portal

Client for the Microsoft Defender for Cloud Apps API

Analyzes Microsoft Defender for Office 365 permissions, directory roles, access types, and authentication modes. Provides tailored recommendations for any missing permissions required to perform specific actions within the Defender portal.

The DFIR-O365RC module will extract logs from the unified audit log (using Exchange Online and Purview), Entra ID Sign In logs, Entra ID Audit Logs, Azure Monitor and Azure DevOps activity logs

Perform comprehensive system diagnostics reporting tasks.

PowerShell module to validate Microsoft Defender for Endpoint (MDE) configurations and security settings.

CIS Microsoft Azure Foundations Benchmark v5.0.0 Compliance Checker. Evaluates Azure subscriptions against 155 CIS controls (93 Automated + 62 Manual) covering Identity, Networking, Security, Storage, Analytics, Compute, and Management services. Generates interactive HTML dashboard, JSON, and CSV reports. Supports multi-subscription scanning with o... More info

PowerShell module for generating primarily Microsoft 365 reports. Analyzes tenant security posture across Conditional Access, Intune, Sentinel, Azure Security, and user/device compliance.

Real-time Windows Event Log monitoring and alerting module for PowerShell. EventMonitor.Windows enables security monitoring, automation, observability pipelines, SIEM integration, telemetry, and AI agent orchestration using EventLogWatcher for instant OS-level event delivery. Monitors 40+ event IDs across 17 groups: logon/logoff, failed authen... More info