Six Questions That Give You the Big Picture

August 7, 2026 · InfraScout Team

The hardest part of a first session is often knowing what to ask. This post walks through six one-sentence questions that work well on day one. Each one needs no knowledge of the underlying tools, fans out across several data sources in parallel, and comes back within minutes as a ranked, visual answer spanning your hosts, your Microsoft cloud tenant, and any external systems you have connected. For each question you see what InfraScout draws on, what the answer looks like, the kinds of things it tends to surface, and a natural follow-up.

The findings described below are patterns that show up across many environments, not results from any one of them. What you see depends entirely on your own data.

Start With Your Security Posture

Give me a security overview of my environment.

This is the broadest question you can ask, and it is fast because it builds on work that already exists. The AI reads the environment context stored from earlier sessions, aggregates your existing findings backlog by severity, status, and category, pulls the critical open items, and renders charts for the severity breakdown and the trend over time.

The answer opens with a backlog summary table: totals, open versus resolved, critical and high counts, the top categories, and the host that carries the most risk. Below it come prioritized clusters of critical findings, each with its impact and a first remediation step. It tends to surface expiring or weak-key certificates where auto-enrollment has quietly stopped working, a privileged cloud account with activity worth reviewing, and a resolution rate that lags well behind the discovery rate. It comes back in a couple of minutes.

A good follow-up is "Which of these critical clusters can we close this week?"

Assess Your Virtualization Platform

Give me an overview of our virtualization environment and assess the most important things.

Here the AI works through a connected virtualization MCP server alongside your stored notes. It shows a visible plan of the assessment areas it intends to cover, then queries hosts, clusters, resource utilization, datastore usage, snapshots, and virtual machine lists in parallel, including the machines with the highest usage. Findings are saved as insights as it goes.

The answer combines a topology diagram, a status table that marks each area as healthy, watch, or critical, and a prioritized list of findings with charts. It tends to surface datastores approaching capacity, CPU over-commitment, memory pressure on some hosts, snapshots that were never cleaned up, old virtual hardware versions with outdated guest tools, and powered-off machines that are candidates for removal. It comes back in a few minutes.

Follow up with "Which snapshots are safe to consolidate first, and what depends on them?"

Turn Defender Signals Into a Plan

Check Defender findings, vulnerabilities and incidents, and collect the recommendations we should implement.

This question splits naturally into three workstreams that run in parallel: endpoint vulnerabilities and recommendations; incidents, alerts, and risk detections; and secure score with its improvement actions. The AI saves findings as insights, draws several charts, and stores the assessment in memory so a later session can pick it up.

The report is ordered by urgency, starting with active incidents, then vulnerabilities, then secure score gaps. It closes with a quick-wins list and a plan split into this week, this month, and next quarter. It tends to surface incidents nobody has triaged yet, recurring directory-enumeration tooling, a directory-replication alert worth checking (sometimes a legitimate sync account), long recommendation lists that need prioritizing, and quick wins such as MFA gaps, legacy authentication, and permission cleanup. It runs for several minutes.

A natural next question is "Walk me through the untriaged incidents, oldest first."

See Which Cloud Services You Really Use

What are the most used cloud services besides Microsoft?

The AI reads Cloud App Discovery data, picks the freshest stream (typically managed endpoints over the last 30 days), ranks the top apps, filters out Microsoft properties, and charts the result.

You get a ranked table with category, transactions, users, and risk score for each service, followed by observations. Generative AI, CDN and infrastructure services, code hosting, and developer tooling tend to dominate, and upload volume to AI providers often stands out. It comes back in a few minutes.

The follow-up most people ask is "Which users upload the most, and where?" This is where the answer gets careful. The discovery data has no per-user traffic attribution, and the AI says so plainly rather than inventing numbers. It offers a clearly labeled proxy instead, showing which users appear on which high-upload services, and recommends a data loss prevention review for the services that matter.

Find What Matters on Your Firewalls

What are the most important events on our firewalls?

This answer draws on a firewall MCP server, a firewall log-analytics MCP server, and Defender advanced hunting. The AI queries attack, virus, system, and VPN events plus alerts in parallel. If you point it at your central log analyzer as the better source, it re-queries there with noise filtered out, and you decide which source is authoritative.

The answer starts with a "clean areas" table covering the things that look healthy, such as no intrusion-prevention or malware detections, healthy high availability, and no unexpected configuration changes. Priority findings follow, each with a chart. It tends to surface large numbers of failed VPN key-exchange attempts and a consumer VPN client running inside the network. It runs for several minutes.

Two follow-ups work well here. Ask the AI to trace the consumer VPN client from the firewall logs through Defender to a specific device, which also explains why that traffic bypasses inspection. Or dig into the VPN failures: the AI reads live tunnel status and separates healthy tunnels from internet-wide scanner noise aimed at your public endpoint.

Understand Your Blocked DNS Traffic

Which DNS queries are blocked most?

With a log-search (SIEM) MCP server connected, the AI first reads index metadata and log formats, then runs parallel queries for the top blocked domains, the top rules, the top clients, and the daily trend, and charts each one.

The answer gives you volume and block-rate figures, then a top table grouped by category: analytics and telemetry, advertising, shopping trackers, and mail trackers. It runs for several minutes, most of it in the follow-up.

That follow-up is "Correlate with the domain controllers' DNS logs to find the real clients." Filtering resolvers usually see only the domain controllers as clients, so the AI parses the domain controllers' DNS debug logs to recover the real source of each query. The result is a ranked client table with each client's dominant categories. Standouts tend to include unsanctioned apps on work machines and a monitoring agent phoning home more than expected.

Why These Make Good First Questions

Each of these questions is a plain sentence. You do not need to know which tools exist, which data source holds the answer, or how to write a query. The AI plans the work, runs independent queries in parallel, and hands back a result that is ranked and charted rather than a raw dump. Several of them also cross domains on purpose: a single answer can connect a firewall event to a Defender device record, or a DNS block to the workstation that caused it, which is exactly the view that is hard to assemble by hand.

What a Good Overview Covers

You can reuse the same shape for any overview question. A useful overview covers:

• Open findings by severity, with resolution velocity and any untriaged incidents
• Identity and privilege hygiene, certificate health, and exposure or secure score gaps
• Infrastructure capacity, snapshots, versions, and over-commitment
• Network threat detections, remote-access health, and policy bypass
• A close that sorts the work into act now, this month, and later

If an answer leaves one of these out, ask for it directly.

Guardrails That Stay in Place

Every question above is read-only analysis. The AI states the limits of the data instead of filling gaps with guesses, and when it uses a proxy method it labels it as one. It proposes follow-ups, such as saving a finding as an insight, rather than acting on its own, and you choose which source is authoritative when more than one could answer. Memory and insights carry the work into later sessions, so the next overview starts where this one ended. Tools from connected external systems are governed by the same tool groups and role tiers as InfraScout's own tools.

TIP

Once an answer looks right, ask the AI to save the key findings as insights. They become the backlog your next security overview builds on.

Next Steps

Set up your first session with the quick start, then learn how to work in Chat. To connect virtualization, firewall, or log-search systems, see MCP servers. To track what you find over time, read about insights.