Defender for Endpoint vulnerability reporting has always been a pain point, and this felt like a great opportunity to use AI-assisted coding to build a dashboard without a dependency on Power BI or other expensive tools. The result is a self-contained HTML dashboard built with PowerShell, along with local scripts, validation tooling, Azure automation assets, GitHub Actions workflows, and sample PDF report outputs.

I have provided the starting prompt and much of the creation history for anyone interested in how it came together here: copilot_all_prompts_2025-12-30T05-04-10.chatreplay.json

flowchart LR
    A["Microsoft Defender for Endpoint"] --> B["Invoke-VulnerabilityExport.ps1"]
    B --> C["VulnExport_current.json.gz"]
    B --> D["VulnHistory_YYYY.json.gz"]
    B --> E["Machines_Current.json.gz<br/>Machines_History.json.gz"]
    B --> F["AdvancedHunting_Current.json.gz<br/>(optional)"]
    C --> G["Generate-VulnerabilityDashboard.ps1"]
    D --> G
    E --> G
    F --> G
    G --> H["VulnerabilityDashboard.html"]
    H --> I["reports/*.pdf"]

1. Export data from Defender for Endpoint.

$secret = Read-Host -AsSecureString -Prompt 'Enter client secret'
.\Invoke-VulnerabilityExport.ps1 `
    -TenantId 'your-tenant-id' `
    -AppId 'your-app-id' `
    -AppSecret $secret `
    -OutputPath .\exports `
    -IncludeAdvancedHunting

2. Generate and validate the dashboard.

.\Generate-VulnerabilityDashboard.ps1 `
    -DirectoryPath .\exports `
    -OutputPath .\VulnerabilityDashboard.html `
    -ExportMachineData $false `
    -Validate

3. Re-run validation later without regenerating the HTML.

.\Generate-VulnerabilityDashboard.ps1 `
    -DirectoryPath .\exports `
    -OutputPath .\VulnerabilityDashboard.html `
    -ValidateOnly

For managed identity auth, Azure provisioning, and GitHub workflow setup, use the linked docs below.

flowchart TD
    A["Same export and generation scripts"] --> B["Run locally"]
    A --> C["Run in Azure Automation"]
    A --> D["Run in GitHub Actions"]
    B --> E["Open HTML directly"]
    C --> F["Publish to blob storage or Container App"]
    D --> G["Commit updated exports and dashboard"]

• azure/Invoke-DashboardPipeline.ps1 is a generated runbook artifact. Edit shared-helpers.ps1 and azure/runbook-source.ps1, then rebuild with .\azure\Build-Runbook.ps1.
• Legacy VulnExport_<group>_<date>.json(.gz) compatibility remains temporary through 2026-07-01.
• Sample PDF outputs are committed under reports/.