# Defender Tvm

> Guidance for Microsoft Defender Threat Intelligence (Defender TI) and Microsoft Defender Vulnerability Management (MDVM) — the threat-and-vulnerability layer of Defender XDR. Covers MDVM exposure score, CVE prioritization with threat insights and active campaigns, security baselines (CIS/STIG), browser-extension and certificate inventory, network share assessment, hardware/firmware inventory, sec…

- **Type:** Skill
- **Install:** `agentstack add skill-vinayaklatthe-microsoft-security-skills-defender-tvm`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [vinayaklatthe](https://agentstack.voostack.com/s/vinayaklatthe)
- **Installs:** 0
- **Category:** [Web & Browser](https://agentstack.voostack.com/c/web-and-browser)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [vinayaklatthe](https://github.com/vinayaklatthe)
- **Source:** https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-tvm

## Install

```sh
agentstack add skill-vinayaklatthe-microsoft-security-skills-defender-tvm
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Microsoft Defender TI & Vulnerability Management

This skill covers two complementary capabilities:

- **Microsoft Defender Vulnerability Management (MDVM)** — risk-based vulnerability
  management for endpoints (Windows, macOS, Linux, mobile), firmware, browser extensions,
  certificates, and security baselines.
- **Microsoft Defender Threat Intelligence (Defender TI / MDTI)** — Microsoft's
  finished-intel and raw-IOC product for adversary tracking, infrastructure pivoting, and
  threat hunting enrichment.

Both feed Defender XDR and Sentinel.

## When to use
- Prioritizing patching/remediation across a large endpoint estate.
- Measuring exposure score and security baseline drift.
- Hunting and responding to threats with adversary intel and infrastructure data.
- Enriching SIEM alerts with intel profiles and indicator context.

**Do not use this skill** for endpoint policy/onboarding (`defender-for-endpoint`), SIEM
detection rules (`sentinel-detection-engineering`), or outside-in attack surface
(`defender-easm`).

## MDVM — what's in core MDE Plan 2 vs the add-on

| Capability | MDE Plan 2 | MDVM Add-on |
|---|---|---|
| CVE-based vulnerability inventory | ✅ | ✅ |
| Exposure score, recommendations | ✅ | ✅ |
| Threat-aware prioritization | ✅ | ✅ |
| Security baselines assessment (CIS, STIG) | — | ✅ |
| Browser extension inventory | — | ✅ |
| Digital certificate inventory | — | ✅ |
| Network share configuration assessment | — | ✅ |
| Hardware & firmware inventory | — | ✅ |
| Block vulnerable applications | — | ✅ |
| Authenticated scan for unmanaged Windows | — | ✅ |

> **Rule of thumb:** If you're already on MDE P2 and your audit team asks for CIS-aligned
> evidence, you need the **MDVM add-on**.

## Approach

### MDVM workflow

1. **Triage by exposure score, not CVE count.** Exposure score weights
   exploitability + asset criticality + active threat campaigns. A 5,000-CVE backlog
   sorted by exposure becomes a 50-task action list.

2. **Use threat insights filters.** Microsoft tags CVEs with: *Public Exploit*,
   *Verified by Microsoft*, *Active Threat Campaign*, *Exploit Available in Kit*. Patch
   Active Threat Campaign first, regardless of CVSS.

3. **Wire remediation to Intune.** "Create remediation request" pushes a task to Intune
   admin queue with the affected device list — the patch lifecycle stays in one place.

4. **Security baselines** (Plan 2 add-on). Pick CIS or STIG, scope to a device group,
   review compliance per setting, prioritize the *security-impacting* settings.

5. **Block vulnerable apps** (add-on). Use sparingly: blocks Adobe Reader 21.x,
   Chrome <120, etc. across the estate. Pilot on a small group; some users have
   legitimate version pins.

6. **Cadence.** Weekly review of top-10 exposure-reducing actions; monthly executive
   exposure-score trend; quarterly baseline drift report.

### Defender TI workflow

1. **Intel profiles** — track named adversaries (e.g., Storm-####), threat tools, CVEs,
   campaigns. Subscribe relevant ones; updates surface in Defender XDR.

2. **Infrastructure pivoting.** Given an indicator (IP, domain, hash), Defender TI shows
   pDNS, WHOIS history, certificate associations, related infrastructure — pivot to find
   adversary infrastructure your SIEM hasn't seen yet.

3. **Bring intel into hunting.**
   - Defender XDR advanced hunting: indicators are first-class joinable entities.
   - Sentinel: connect MDTI via the **Threat Intelligence Premium** data connector;
     `ThreatIntelligenceIndicator` and articles populate.

4. **MDTI API for automation.** Pull articles/indicators into a SOAR playbook for
   auto-enrichment of incidents.

5. **Free vs Premium.** Defender TI portal has a free tier (limited articles,
   pivots/day); Premium unlocks unlimited pivots, full intel-profile catalogue, and API
   throughput. Most enterprise SOC use needs Premium.

## Guardrails
- **Don't drown in CVE counts.** Exposure score + threat insight is the actionable view.
  Counting CVEs is a vanity metric.
- **MDVM remediation needs an owner.** Surfacing 200 recommendations in a dashboard with
  no Intune integration / patch owner produces no patches.
- **Block-vulnerable-apps is invasive.** Pilot. Communicate. Some apps must be pinned for
  business reasons.
- **Security baselines are a journey.** 100% CIS compliance is rarely achievable or
  desirable; pick the security-impacting subset.
- **Intel without context is noise.** Don't ingest every MDTI indicator into a Sentinel
  watchlist as a "match-and-alert" — match-rate × low fidelity = alert fatigue.
- **Confirm licensing.** MDTI Premium and the MDVM add-on are separately licensed;
  customers often think they're included in M365 E5 — they aren't.
- **Scan results lag** by hours; don't expect minute-by-minute vuln status.

## Common anti-patterns
- **"Patched 1,000 medium CVEs while a critical exploited CVE sat for 60 days"** — sort
  by threat campaign, not CVSS bucket.
- **"Bought MDVM add-on for the exposure score we already had in MDE P2"** — overlap.
  Map features before buying.
- **"All MDTI indicators auto-blocked at the firewall"** — false-positive blast.
  Pivot/validate first.
- **"Security baseline 'Compliance' score treated as security score"** — they're not the
  same; many baseline settings are operational hardening, some are not security-critical.
- **"Intel profile subscriptions = no triage"** — articles need analyst triage to
  translate to detections/blocks.
- **"Authenticated scan on every unmanaged Windows host without scoping"** — generates
  service-account auth events at scale; coordinate with identity team.

## Example prompts
- `Top 10 actions to reduce our exposure score by 20% this quarter.`
- `Patch prioritization runbook: how to use threat insights to triage 8,000 open CVEs.`
- `Roll out CIS Windows baseline assessment across 30,000 endpoints.`
- `Wire MDVM remediation requests to Intune and an ITSM ticket queue.`
- `Pivot from a suspicious domain to related adversary infrastructure using MDTI.`
- `Connect MDTI Premium to Sentinel and build a hunting workbook.`
- `Pilot block-vulnerable-apps for outdated Java runtimes on dev machines.`
- `Build a quarterly executive exposure-score and intel-profile briefing.`

## Microsoft Learn
- MDVM overview: https://learn.microsoft.com/defender-vulnerability-management/defender-vulnerability-management
- MDVM capabilities by SKU: https://learn.microsoft.com/defender-vulnerability-management/defender-vulnerability-management-capabilities
- Exposure score: https://learn.microsoft.com/defender-vulnerability-management/tvm-exposure-score
- Threat insights & prioritization: https://learn.microsoft.com/defender-vulnerability-management/tvm-weaknesses
- Security baselines assessment: https://learn.microsoft.com/defender-vulnerability-management/tvm-security-baselines
- Block vulnerable apps: https://learn.microsoft.com/defender-vulnerability-management/tvm-block-vuln-apps
- Defender TI overview: https://learn.microsoft.com/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti
- Intel profiles: https://learn.microsoft.com/defender/threat-intelligence/using-tags
- MDTI in Sentinel: https://learn.microsoft.com/azure/sentinel/understand-threat-intelligence

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [vinayaklatthe](https://github.com/vinayaklatthe)
- **Source:** [vinayaklatthe/microsoft-security-skills](https://github.com/vinayaklatthe/microsoft-security-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-vinayaklatthe-microsoft-security-skills-defender-tvm
- Seller: https://agentstack.voostack.com/s/vinayaklatthe
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.