Your Endpoints Are Running Local AI Agents — Can You See Them?

This guidance explains how to use the AIAgentsInfo Advanced Hunting table in Microsoft Defender XDR to inventory and investigate local and third-party AI agents (e.g., Copilot, Azure AI Foundry, Anthropic) using provided KQL queries, and highlights the telemetry fields available (device, vendor, account, process, publishing status, block status, etc.) for security monitoring and reporting.