KQL Investigation Planner

Turn an authorized defensive security question into a bounded investigation plan and read-only KQL drafts. Receive investigation scope, schema assumptions, staged query drafts, interpretation guidance, and evidence gaps. Provide a sanitized security question, time range, and relevant schema. This advisory workflow does not connect to systems or run queries; validate proposed queries in your authorized environment. One-time purchase; your AI assistant and source-system licenses are separate.