Entity Guard Investigator Agent

The Entity Guard Investigator Agent determines whether identities and related entities referenced by a Microsoft Defender incident are compromised. Starting from a Defender IncidentId, the agent extracts entities (users, email addresses & message IDs, devices, IPs, URLs/domains, file hashes), enriches them with Microsoft Entra identity signals, Defender device posture, Threat Intelligence (DTI) reputation, and optionally Intune compliance. It then produces a human-readable verdict per entity with concise evidence and prioritized actions.