A free, powerful Windows desktop application for monitoring, managing, and diagnosing Microsoft Defender for Endpoint — built with WPF and .NET 8
✓ Free & Open Source ✓ No Account Required ✓ Windows 10/11 ✓ .NET 8
The two biggest additions in recent releases. Both are built for the same question: is this machine safe right now, and if not, what do I do about it?
ASR rules now get a proper workspace: one grid that tells you what mode every rule is really in and where that setting came from, plus a new Events page for investigating what got blocked and safely tuning it.
Type in up to 25 device names and get a one-page verdict for each — healthy, needs attention, or investigate now — with the evidence and the fix attached. No hunting queries to write.
One tool to view, analyze, diagnose, and manage your endpoint security configuration
Comprehensive security posture assessment with actionable recommendations, category breakdowns, and priority-based remediation guidance.
View deployed WDAC policies, scan files against policy, run CiTool commands, and analyze Code Integrity configuration.
Manage USB and removable device policies. View, create, edit, and export device control configurations with a visual policy editor.
See every Attack Surface Reduction rule's enforcement mode and whether it is pushed by Intune/GPO or set locally. Investigate blocks and warn-bypasses grouped by rule and process, then create audited permanent or auto-expiring exclusions. Learn more →
Triage up to 25 devices at once from Advanced Hunting. Each one gets a plain-English verdict, the evidence behind it, and copy-paste remediation. Learn more →
Parse firewall logs, view WFP filter summaries, browse firewall rules, and analyze network policy enforcement.
Analyze Defender support bundles (MpSupportFiles.cab), parse logs, detect issues, and export diagnostic reports.
Connect to Azure OpenAI or OpenAI to get AI-powered security analysis, risk summaries, and remediation suggestions.
Capture network traces with netsh, configure scenarios and providers, and auto-stop on firewall drops with the built-in drop monitor.
Create and evaluate compliance policies against your endpoint, including DISA STIG baselines for Defender AV and Firewall.
Run CiTool.exe commands directly from the app — list policies, refresh CI engine, get device ID, and view live streaming output.
Connect to remote machines via WinRM or PsExec to monitor and diagnose MDE on other workstations across your network.
Built-in reference for MDE components, ASR rules, and troubleshooting scenarios with links to official documentation.
Deploy via MSI with dual scheduled tasks: SYSTEM collects telemetry every 8 hours, the logged-on user uploads to Azure using their Entra identity. No secrets on endpoints.
Upload health snapshots to an Azure Function App or directly to Blob Storage. Managed Identity auth, Table Storage for Power BI dashboards, Gov Cloud supported.
Modern Fluent WPF interface with Mica backdrop, designed for Windows 10 & 11
Dashboard Overview
Antivirus Status
Defender Policies
Application Control
Device Control
Compliance Dashboard
Knowledge Base
Free and open source. No account required.