MS Defender MCP

MCP防御器

用于Microsoft Defender高级搜索的MCP（模型上下文协议）服务器。通过将查询翻译为KQL并对Defender执行查询，使AI助手能够使用自然语言调查安全事件。

运作原理

User: "Show me suspicious PowerShell activity in the last hour"
  ↓
AI translates to KQL using schema knowledge
  ↓
MCP executes query against Defender API
  ↓
AI interprets and explains the results

特性

• 高级狩猎：针对Defender的Advanced Hunting API执行KQL查询
• 动态模式发现：直接从Defender实例获取可用的表和列
• 自然语言安全调查：让AI将您的问题翻译成KQL
• 证书认证：使用Azure AD证书进行安全身份验证（推荐）

先决条件

• Python 3.10+
• 具有WindowsDefenderATP权限的Azure AD应用程序注册：

- AdvancedQuery.Read.All -运行高级查询

安装

# Clone the repository
git clone https://github.com/yourusername/mcp-defender.git
cd mcp-defender

# Create and activate virtual environment
python -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate

# Install dependencies
pip install -e ".[dev]"

配置

1. 复制 .env.example 到 .env
2. 填写您的Azure AD凭据：

AZURE_TENANT_ID=your-tenant-id
AZURE_CLIENT_ID=your-client-id

# Option 1: Certificate authentication (recommended)
AZURE_CLIENT_CERTIFICATE_PATH=/path/to/combined.pem

# Option 2: Client secret authentication
# AZURE_CLIENT_SECRET=your-client-secret

证书设置

对于证书身份验证，请将私钥和证书组合在一起：

cat private.key cert.pem > combined.pem

用法

运行服务器

mcp-defender

MCP检验员测试

npx @modelcontextprotocol/inspector mcp-defender

Claude桌面配置

添加到您的Claude桌面配置(~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "defender": {
      "command": "/path/to/mcp-defender/.venv/bin/python",
      "args": ["-m", "mcp_defender.server"],
      "env": {
        "PYTHONPATH": "/path/to/mcp-defender/src",
        "AZURE_TENANT_ID": "your-tenant-id",
        "AZURE_CLIENT_ID": "your-client-id",
        "AZURE_CLIENT_CERTIFICATE_PATH": "/path/to/combined.pem"
      }
    }
  }
}

可用工具

自然语言查询示例

一旦连接到克劳德，你可以问：

• *“显示过去一小时内任何可疑的PowerShell活动”*
• *“查找登录尝试失败的设备”*
• *“哪些进程正在与外部IP进行网络连接？”*
• *“列出7天内未登记的所有设备”*

KQL查询示例

// Find failed logon attempts
DeviceLogonEvents
| where ActionType == "LogonFailed"
| where Timestamp > ago(24h)
| summarize FailedAttempts = count() by AccountName, DeviceName
| top 10 by FailedAttempts

// Detect suspicious PowerShell
DeviceProcessEvents
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("encodedcommand", "bypass", "hidden", "downloadstring")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine

// Network connections to external IPs
DeviceNetworkEvents
| where RemoteIPType == "Public"
| where Timestamp > ago(1h)
| summarize ConnectionCount = count() by DeviceName, RemoteIP
| top 20 by ConnectionCount

发展

# Run tests
pytest

# Lint code
ruff check .

# Type check
mypy src

# Security scan
bandit -r src

API 参考

此服务器使用WindowsDefenderATP API：

• 端点: https://api.securitycenter.microsoft.com
• 高级狩猎: POST /api/advancedqueries/run

许可证

麻省理工学院