Bi Yue Xu
@biyuexuColorado, USCompletionist
1 follower4 downloads175 copies0 likes384 views
33 detections
Filters
Last updated
All Time
Detection languages
33
Categories
4
2
2
2
1
Platforms
1
This query retrieves the latest local AI agent information from the past 30 days for a specified device, including agent details, vendor, version, related process, MCP servers, trust settings, and account information.
This query provides a current-state view of local AI agents discovered by MDE across endpoints.
Provides detailed information about local AI agents associated with a specific user, including vendor, version, creation date, MCP servers, related processes, trust status, auto-approval settings, device, and account details.
This query retrieves the latest metadata for each published AI agent, including ownership, platform, model, version, MCP servers, tools, authentication, permissions, sharing, and other agent details.
Identifies the five most commonly observed local AI agent vendors across devices, using the latest record for each unique AgentId.
Identifies user accounts associated with three or more local AI agents and lists the agents and devices observed for each user, helping highlight users with significant AI agent activity.
Identifies devices running more than three local AI agents and lists the agents detected on each device, helping uncover systems with a high concentration of AI agent activity.
Identifies local AI agent vendor across devices and ranks agent vendors by the number of unique agents observed, using the latest record for each AgentId.
This query provides a detailed event-level view of URLs surfaced through Microsoft Copilot, including the user, action taken, click-through status, URL, and URL redirect chain. It enables security teams to trace individual Copilot URL events and investigate potentially risky or blocked URLs, including user activity and redirect paths.
This query hunts across your organization for users receiving a burst of emails from multiple senders or domains, to help uncover potential email bombing activity. It highlights who was targeted, how much email they received, and how diverse the senders and domains were, with configurable thresholds to fit your environment.
Page 1 of 4