[inwafula]

The RiskState filed in the query within the plugin is not yet in public preview and so not available to non-participating customers. It leads to a failure of execution if run on those workspaces

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Sean Kwach Wasonga (KwachSean)]

Breakdown of Changes

1. New VSCode Settings File
   File:
   .vscode/settings.json
   Details:

Configures VSCode to ignore "main" branch in GitHub Pull Requests.
2. New Plugin: Devices Onboarded into Microsoft Defender for Endpoint (MDE)
Directory:
Plugins/Community Based Plugins/Microsoft Graph API plugins/Devices Onboarded into MDE/

Files Added:

MDEOnboardedDevices-OpenAPISpec.yaml

Provides an OpenAPI 3.0 spec for retrieving MDE onboarded devices via Microsoft Graph API.
Defines /devices endpoint, expected schema, authentication, and sample natural language prompts.
MDEOnboardedDevicesPlugin.yaml

Plugin manifest describing name, display name, purpose, AAD authentication, and points to the OpenAPI spec.
Readme.md

Explains plugin purpose, features, setup, usage examples, and links to documentation.
3. Update to Existing Plugin
File:
Plugins/Community Based Plugins/Microsoft Sentinel Custom Plugin Scenarios/High Blast Radius User investigation/HighBlastRaidusUserInvestigation.yaml
Change:

Removes the RiskState field from the output properties in the SkillGroups section.
Approval Review
LGTM! 👍

The addition of the "Devices Onboarded into Microsoft Defender for Endpoint (MDE)" plugin is thorough, with a clear OpenAPI spec, manifest, and detailed documentation.
The VSCode settings file provides a minor but useful dev environment improvement.
The removal of RiskState from the Sentinel scenario output is straightforward and does not impact the core plugin functionality.