Support

Audits a live website and, if you want, the source code behind it, then writes a report with findings, a vulnerability assessment and a prioritized action plan.

1. Open Website & Security Audit and enter the address to audit.
2. Optional: upload the project folder so the code is scanned too, and list any concerns you want the report to focus on.
3. Start the run. The progress tape on the right shows each stage as it happens.
4. Read the report as sections finish. Findings are rated from critical to info.
5. Use re-run to repeat an audit, or quick-check a single section after you fix something.
6. Export the report when you are done.

Turns questions and audit findings into a scored risk register you can explain to the people who sign off.

1. Open Risk Assessment and create an assessment from one of the templates.
2. Answer the questionnaire. Each answer feeds a likelihood and impact score.
3. Review the register. Inherent and residual scores stay in step with the open items behind them.
4. To pull in an audit, open the audit, choose a finding, and add it to an existing assessment or a new one.
5. Generate the AI executive summary for the one-page version.

K-Defender does not lock you to one AI. Each job can use a different model.

1. Select the gear icon to open Settings.
2. Pick a provider: Ollama (local), Ollama Cloud, Qwen Cloud, OpenRouter, or another you configure.
3. Paste its key and select Test & Load Models. The list shows each model with its price per million tokens.
4. Assign a model to each role: analysis, vision, security and synthesis. Risk summaries have their own role.

Use a cheaper model for bulk work and a stronger one for the security analysis and executive summaries.

A local copy of the public CVE list. Audits use it to match your dependencies and server banners against known vulnerabilities.

• Desktop: downloads once on first launch. Refresh it yourself with the refresh button whenever you want newer data. It never updates in the background.
• Enterprise: syncs every hour on its own in a separate container.

Audits still run while it downloads. Only the dependency CVE checks wait.

Collects events from your security tools and turns them into tickets. It has three tabs: Tickets, Events and Settings.

Event sources

• Azure Event Hub: for Microsoft Defender XDR, Entra and Azure. In the Defender portal, stream only alerts and behaviors. Streaming every raw event is expensive and unreadable.
• Syslog: point a firewall at the server on UDP port 514.
• Webhooks: create a tokened URL in Settings and post JSON to it. Fields named severity, host and message are picked up automatically.

Keeping it quiet

Set the minimum severity, choose whether to drop events the app does not recognize, and add patterns to exclude. Dropped events never reach the AI and never appear on screen.

The AI reads each new event and either opens a ticket or adds it to one that already exists.

• List and detail: pick a ticket on the left to read it on the right. Filter the list to find what you need.
• Categories: the AI picks a category and subcategory from your list. Edit the list in Settings.
• Owner: assign any user or group from your Entra directory.
• Grouping: events with the same category, subcategory and host within 24 hours share one ticket.
• Notes and status: every change is recorded with who made it and when.
• From an event: open any event in the Events tab and create a ticket from it yourself.

If the AI cannot answer three times in a row, a basic ticket is still opened so nothing is lost.

Microsoft Teams

1. In Teams, open the Workflows app and choose a template that posts webhook alerts to a channel, or to a chat with the Workflows bot.
2. Pick the team and channel, then save. Copy the webhook URL it gives you.
3. In K-Defender, Log Monitor, Settings, paste it under alert webhooks and select Send test.

Email digests

1. Register an app in Entra with the Microsoft Graph Mail.Send application permission and grant admin consent.
2. In Settings, enter the tenant, client ID and secret, the mailbox to send from, and the recipients.
3. Select Save and send test email.

Limit that app to one mailbox group with Exchange role-based access, so a leaked secret cannot send as anyone in your company.

Sign-in uses Microsoft Entra ID. What a person sees depends on their groups.

• Admin: everything, including Settings.
• Audit, Risk, Monitoring: each has a read group and a write group.
• Owner list: to show every user and group in the assign menu, give the app the GroupMember.Read.All application permission and grant admin consent.

Group changes apply the next time someone signs in.

• Plans: Monthly at $4.99, Annual at $44.99. Both unlock every feature.
• Already subscribed? On the subscribe screen choose I already subscribed. The app checks the Microsoft Store.
• License key: choose I have a license key, paste the whole key including the KD1- at the start, and select Activate key.
• Offline: a subscription the app saw as active in the last 7 days keeps working without a connection.
• Cancel: manage the subscription in your Microsoft account. Your data stays on your computer.

K-Defender only knows Teams accepted the request. Teams then runs your workflow, and that can fail on its own.

1. In Teams, open Workflows, then your flow, then Run history.
2. If the run failed with not a ChatThread, the destination is your own self-chat. Switch the flow to a channel.
3. If there is no run at all, copy the webhook URL again from the flow's trigger and paste it into Settings.

Choose I already subscribed on the subscribe screen. Make sure the Microsoft Store is signed in with the same account you bought with. The app also checks the Store at launch and every 30 minutes.

• Paste the entire key, starting with KD1-, with no spaces or line breaks.
• Keys can expire. Check the date we gave you.

Still stuck? Send us the key and we will check it.

The app resumes unfinished runs the next time it opens, and re-checks every 30 seconds while it is open. The live progress tape only keeps what happened in the current session, so a resumed run starts a fresh tape.

AADSTS50011 means the redirect address in Entra does not exactly match the one K-Defender uses. Copy it from Settings, Microsoft sign-in, and paste it into the app registration. Match the scheme, host and path exactly, including any trailing slash.

Give the K-Defender app registration the GroupMember.Read.All application permission and grant admin consent. Then reopen the ticket.

• Check that Mail.Send is an application permission, not delegated, and that admin consent is granted.
• If you limited the app with Exchange role-based access, the sending mailbox must be a direct member of the allowed group. Changes can take 30 minutes to 2 hours to apply.

• Too many: in the Defender portal, stream only alerts and behaviors. In Log Monitor, Settings, raise the minimum severity and turn on dropping unrecognized events.
• None: confirm the event hub exists and the consumer group is $Default. K-Defender reads from the newest event when it starts, so events sent while it was off are not replayed.