maximusfisher.com

What It Is

Maximus Fisher’s page showcases a portfolio of AI security tools and personal projects for SMB and enterprise environments, rather than a fully commercialized cybersecurity product. Its core focus is connecting Claude to the Microsoft security stack via MCP servers, including Microsoft Defender XDR and Microsoft Sentinel, for Advanced Hunting KQL queries, reading incidents and alerts, building detection pipelines, and supporting red-team evaluation.

Core Capabilities and Security Design

Disclosed projects include mcp-defender-xdr and mcp-sentinel-detection-engine. The former exposes Defender XDR Advanced Hunting KQL, incidents, and alerts to Claude, emphasizing read-only access, certificate-based authentication, and multi-tenancy. The latter exposes a Sigma → KQL → Microsoft Sentinel Terraform pipeline to Claude, using local stdio, certificate-based Azure authentication, and a “read-only by construction” approach. These design choices show a clear focus on permission boundaries when bringing AI into security operations, making the tools suitable for SOC analysis, detection engineering, and automation experiments.

Deployment, Integrations, and Alert Management

Deployment information is limited, but the text explicitly mentions local stdio, Azure certificate authentication, multi-tenancy, and read-only access. The integration focus is mainly on Microsoft Defender XDR, Sentinel, Entra, Claude, Sigma, KQL, and Terraform. For management and alerting, the tools can read Defender XDR incidents and alerts and connect the detection-rule engineering workflow to Sentinel. However, there is no clear description of a full console, auditing, alert orchestration, or ticketing-system capabilities.

Pricing, Compliance, and Support

The page does not disclose pricing models, payment methods, SLAs, enterprise support, or compliance certifications. The author currently serves as Cyber Lead / L3 Tech at Propulsion Tech and mentions experience operating MSP security stacks, including Huntress, ThreatLocker, email security, DLP, and RMM/PSA. However, this should not be treated as a formal service commitment for the products on the site.

Pros, Cons, and Who It Is For

The main strengths are a clear technical focus, deep alignment with the Microsoft security ecosystem, and a relatively cautious read-only and certificate-based authentication design for combining AI with SOC workflows. The drawbacks are unclear product maturity and the lack of documentation, pricing, compliance information, support details, and real-world deployment cases. It is best suited for enterprise security teams or MSPs that already use Microsoft Defender/Sentinel, have security engineering capabilities, and want to explore Claude-assisted detection and alert analysis. Access, payment, and delivery information for China is unknown. If localized alternatives are needed, consider Microsoft Sentinel’s native capabilities, Splunk SOAR, Cortex XSOAR, Elastic Security, Wazuh, or domestic security operations platforms.