LOX Agent Investigation Coach

Inputs: Microsoft Defender XDR alerts and Advanced Hunting telemetry, CrowdStrike Falcon alert and device records, Microsoft Threat Intelligence indicator context, and analyst natural-language prompts (alert IDs, hostnames, UPNs, file hashes, IPs, CVEs).

Tasks: Correlates Defender XDR alerts with CrowdStrike Falcon detections for the same host or user, enriches every indicator (IP, domain, URL, file hash, CVE) through Microsoft Threat Intelligence, runs 145+ KQL hunting skills spanning endpoint, identity, email, and cloud-app telemetry, assesses CrowdStrike prevention status via bitmask and sensor , and coaches the analyst through structured investigation with explicit next-step skill invocations.

Outputs: Prioritized (P1–P4) triage narrative with MITRE ATT&CK tactic and technique mapping, cross-EDR correlation showing where Defender and CrowdStrike agree or disagree for each finding, source-labeled data blocks, and concrete containment and remediation recommendations.