Security Copilot

The cybersecurity landscape faces an unprecedented challenge: a global talent shortage of over 3.4 million security professionals, while adversaries deploy increasingly sophisticated AI-driven attacks. Security Operations Centers (SOCs) are drowning in alerts, with the average enterprise processing thousands of incidents daily. Microsoft Security Copilot represents a paradigm shift in this equation, bringing GPT-4-powered AI directly into the defender’s workflow to accelerate threat investigation, automate incident triage, and translate complex security data into actionable intelligence through natural language. This guide provides a deep technical exploration of the platform’s architecture, integration points, and practical deployment strategies for security teams ready to operationalize AI-powered defense.

What Is Microsoft Security Copilot?

Microsoft Security Copilot is a generative AI-powered security analysis tool built on top of OpenAI’s GPT-4 model, enriched with Microsoft’s proprietary security-specific models and a massive threat intelligence graph that processes 78 trillion security signals every day. Unlike general-purpose AI assistants, Security Copilot is purpose-built for cybersecurity workflows: it understands the language of threat actors, MITRE ATT&CK techniques, Common Vulnerabilities and Exposures (CVEs), and the operational context of enterprise security operations.

The platform operates through a prompt-based interface where analysts interact with their entire security estate using natural language. Instead of manually pivoting across multiple consoles, writing KQL queries from scratch, or correlating alerts across disparate tools, analysts describe what they need and Security Copilot synthesizes responses from across the Microsoft security ecosystem and third-party sources.

How Security Copilot Processes a Query

When an analyst submits a prompt, the system orchestrates a sophisticated multi-step pipeline. The orchestration engine first classifies the intent, then selects the appropriate plugins and data sources, executes the necessary queries, and synthesizes the results into a coherent response grounded in real security telemetry.

// Security Copilot Query Processing Pipeline

Analyst Prompt
  // "Summarize the incident involving user jdoe@contoso.com"
    |
    v
Orchestration Engine
  ├── Intent Classification (incident summary)
  ├── Plugin Selection (Defender XDR, Entra ID, Sentinel)
  └── Context Assembly (tenant data, session history)
    |
    v
Parallel Data Retrieval
  ├── Defender XDR  → Incident alerts, timeline, entities
  ├── Entra ID      → User risk score, sign-in logs
  └── Sentinel      → Related hunting queries, logs
    |
    v
GPT-4 + Security Models
  ├── Threat correlation & analysis
  ├── Severity assessment
  └── Remediation recommendations
    |
    v
Structured Response to Analyst
  ├── Incident summary in natural language
  ├── MITRE ATT&CK mapping
  ├── Suggested next steps
  └── Pinboard for session continuity

Core Capabilities

Incident Summarization

One of the most impactful capabilities is automated incident summarization. Security Copilot can take a complex, multi-alert incident spanning hours or days and distill it into a clear narrative that includes the attack timeline, affected assets, techniques used, and current containment status. This transforms what traditionally takes a senior analyst 30-60 minutes into a task completed in seconds.

// Example: Incident Summarization Prompt

Prompt: "Summarize incident #4892 including the full attack
timeline, all affected entities, MITRE ATT&CK techniques
identified, and current containment status."

// Security Copilot Response (summarized):
Incident #4892 - Multi-Stage Ransomware Attack
Severity: High | Status: Active | Duration: 14 hours

Timeline:
  03:22 UTC - Initial access via phishing email (T1566.001)
  03:45 UTC - Credential harvesting from user endpoint (T1003)
  04:12 UTC - Lateral movement to file server (T1021.002)
  06:30 UTC - Data staging on compromised server (T1074)
  08:15 UTC - Encryption initiated on 3 endpoints (T1486)

Affected Entities:
  Users: jdoe@contoso.com, admin-svc@contoso.com
  Devices: WKS-1042, SRV-FILES-02, SRV-FILES-03
  Mailboxes: 1 compromised

Containment: 2 of 3 affected devices isolated

Threat Intelligence Analysis

Security Copilot provides deep threat intelligence analysis by correlating indicators of compromise (IOCs) against Microsoft’s global threat intelligence graph, which aggregates data from billions of endpoints, cloud workloads, email messages, and identity signals worldwide. Analysts can query specific indicators and receive enriched context instantly.

// Example: Threat Intelligence Query

Prompt: "What is known about the threat actor group
associated with IP 203.0.113.42? Include their TTPs,
known campaigns, and recommended mitigations."

// Security Copilot correlates across:
  Microsoft Threat Intelligence - Actor profiles & campaigns
  Defender TI - Infrastructure mapping & IOC enrichment
  Open-source feeds - STIX/TAXII, abuse databases
  Tenant telemetry - Historical interactions with the IP

Script and Command Analysis

Security analysts frequently encounter obfuscated scripts during incident response, from PowerShell download cradles to encoded batch files. Security Copilot can deobfuscate, analyze, and explain these scripts in plain language, identifying the intent and potential impact without requiring the analyst to be an expert in every scripting language.

// Example: Script Analysis Prompt

Prompt: "Analyze this obfuscated PowerShell command found on
endpoint WKS-1042 and explain what it does, its risk
level, and which MITRE techniques it maps to."

// Security Copilot deobfuscates and explains:
Analysis Result:
  Purpose: Downloads and executes a second-stage payload
  Risk Level: Critical
  Techniques: T1059.001 (PowerShell), T1105 (Ingress Tool Transfer)
  Indicators: Connects to external C2 infrastructure
  Recommendation: Isolate endpoint, block domain at proxy

KQL Query Generation

Kusto Query Language (KQL) is the backbone of Microsoft’s security analytics across Sentinel, Defender, and Log Analytics. Security Copilot translates natural language requests into production-ready KQL queries, dramatically lowering the barrier for junior analysts while accelerating query development for experienced ones.

// Prompt: "Write a KQL query to find all successful logins
// from impossible travel locations in the last 7 days"

// Generated KQL:
let timeRange = 7d;
let maxTravelSpeedKmH = 900;
SigninLogs
| where TimeGenerated > ago(timeRange)
| where ResultType == "0"  // Successful logins only
| extend Latitude = toreal(LocationDetails.geoCoordinates.latitude)
| extend Longitude = toreal(LocationDetails.geoCoordinates.longitude)
| sort by UserPrincipalName asc, TimeGenerated asc
| serialize
| extend PrevLat = prev(Latitude), PrevLon = prev(Longitude)
| extend PrevTime = prev(TimeGenerated)
| extend PrevUser = prev(UserPrincipalName)
| where UserPrincipalName == PrevUser
| extend DistanceKm = geo_distance_2points(
    Longitude, Latitude, PrevLon, PrevLat) / 1000
| extend TimeDiffHours = datetime_diff(
    'hour', TimeGenerated, PrevTime)
| where TimeDiffHours > 0
| extend SpeedKmH = DistanceKm / TimeDiffHours
| where SpeedKmH > maxTravelSpeedKmH
| project TimeGenerated, UserPrincipalName,
    IPAddress, Location, DistanceKm, SpeedKmH

Vulnerability Assessment

Security Copilot integrates with Defender Vulnerability Management to provide contextual vulnerability assessments. Rather than presenting a flat list of CVEs, it prioritizes vulnerabilities based on your specific environment, considering exploitability, asset criticality, exposure level, and active threat actor campaigns targeting those vulnerabilities.

Integration with Microsoft Security Products

Security Copilot draws its power from deep native integration with Microsoft’s security product suite. Each product connection exposes specific capabilities through plugins, allowing the AI to query, correlate, and act across the entire security estate.

Microsoft Defender XDR

The Defender XDR integration is the most comprehensive, providing access to incidents, alerts, device inventories, email analysis, and automated investigation data. Security Copilot surfaces directly within the Defender XDR portal, offering contextual assistance alongside your existing workflow.

// Defender XDR Integration Prompts

Incident Analysis:
"Show me all high-severity incidents from the last 24 hours
that involve lateral movement techniques."

Email Threat Analysis:
"Analyze the email headers and attachments from the phishing
campaign targeting our finance department this week."

Device Investigation:
"What processes were running on device WKS-1042 at the time
of the initial compromise? Highlight any anomalous activity."

Automated Response:
"What automated investigation actions have been taken on
incident #4892 and what is the current remediation status?"

Microsoft Sentinel

The Sentinel integration connects Security Copilot to your SIEM data lake, enabling natural language searches across log sources, automated hunting query generation, and analytics rule creation. Analysts can ask questions across terabytes of log data without writing a single line of KQL themselves.

// Prompt: "Search Sentinel logs for any data exfiltration
// indicators from the compromised user account in the
// last 48 hours"

// Generated Sentinel Hunting Query:
let compromisedUser = "jdoe@contoso.com";
let lookback = 48h;
union
  (OfficeActivity
    | where TimeGenerated > ago(lookback)
    | where UserId =~ compromisedUser
    | where Operation in ("FileDownloaded", "FileSyncDownloadedFull")
    | summarize DownloadCount = count(),
        TotalSize = sum(OfficeObjectId) by bin(TimeGenerated, 1h)),
  (CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where SourceUserName =~ compromisedUser
    | where DeviceAction == "Allow"
    | where SentBytes > 50000000  // 50MB+ transfers
    | project TimeGenerated, DestinationIP,
        DestinationPort, SentBytes)
| sort by TimeGenerated desc

Microsoft Intune

The Intune plugin gives Security Copilot visibility into device compliance, configuration policies, and application management. This is particularly valuable during incident response when you need to quickly assess whether a compromised device meets your security baseline or identify policy gaps that may have contributed to the breach.

// Intune Integration Prompts

Compliance Check:
"What is the compliance status of device WKS-1042?
List any policy violations and when they were last evaluated."

Policy Gap Analysis:
"Which devices in the Finance department are missing
BitLocker encryption or have outdated antivirus definitions?"

App Risk Assessment:
"List all unmanaged applications installed on devices
owned by users involved in incident #4892."

Microsoft Entra ID

Entra ID integration surfaces identity-centric insights: risky user profiles, anomalous sign-in patterns, conditional access policy evaluations, and privilege escalation indicators. For identity-driven attacks, which account for the vast majority of breaches, this integration is critical.

// Entra ID Integration Prompts

Risky User Analysis:
"Show me the complete risk profile for user jdoe@contoso.com
including recent sign-in anomalies, risk detections, and
any conditional access policy failures."

Privilege Audit:
"List all users who were granted Global Administrator or
Security Administrator roles in the past 30 days, including
who approved the assignment."

Access Review:
"Which service principals have excessive permissions and
have not been used in the last 90 days?"

Microsoft Purview

The Purview integration connects data governance and compliance insights to the security workflow. Security Copilot can assess data exposure risks, identify sensitive data involved in security incidents, and generate compliance impact reports for regulatory requirements.

Promptbooks: Automated Investigation Workflows

Promptbooks are one of Security Copilot’s most powerful features for operationalizing institutional knowledge. A promptbook is an ordered sequence of prompts that execute together, creating a repeatable investigation workflow. They function as automated runbooks powered by natural language, enabling SOC teams to standardize investigation procedures while leveraging AI at each step.

Pre-Built Promptbooks

Microsoft ships a library of pre-built promptbooks covering common security scenarios. These serve as starting points that teams can customize for their specific environment and procedures.

Creating Custom Promptbooks

Custom promptbooks allow security teams to encode their specific investigation methodologies, compliance requirements, and organizational context into reusable workflows. Each step in a promptbook can reference outputs from previous steps, building a chain of analysis.

// Custom Promptbook: Phishing Investigation
{
  "name": "Phishing Campaign Investigation",
  "description": "Comprehensive phishing analysis workflow",
  "tags": ["phishing", "email", "incident-response"],
  "prompts": [
    {
      "step": 1,
      "prompt": "Analyze the email headers and identify
        the true sender, originating infrastructure, and
        any authentication failures (SPF/DKIM/DMARC)."
    },
    {
      "step": 2,
      "prompt": "Check Microsoft Threat Intelligence for
        the sender domain and any URLs found in step 1.
        Is this associated with a known campaign?"
    },
    {
      "step": 3,
      "prompt": "How many users in our organization received
        similar emails? List all recipients and whether
        they clicked any links or opened attachments."
    },
    {
      "step": 4,
      "prompt": "For any users who interacted with the
        phishing email, check their Entra ID sign-in
        logs for anomalies in the last 24 hours."
    },
    {
      "step": 5,
      "prompt": "Generate a summary report of this phishing
        campaign including IOCs, affected users, current
        risk level, and recommended remediation steps."
    }
  ]
}

Custom Plugins: Extending Security Copilot

Security Copilot’s plugin architecture allows organizations to connect custom data sources, proprietary threat intelligence feeds, and internal tools. Plugins are defined using an OpenAPI specification, making them accessible to any team with REST API experience. This extensibility transforms Security Copilot from a Microsoft-centric tool into a unified security analysis platform.

Plugin Types

• Microsoft plugins – Pre-built connections to Microsoft security products (Defender, Sentinel, Intune, Entra ID, Purview)
• Third-party plugins – Integrations from partners like ServiceNow, Splunk, and CrowdStrike
• Custom plugins – Organization-built plugins connecting internal APIs, threat feeds, and proprietary data sources
• Website plugins – Plugins that can ingest and reason over content from specific websites or documentation portals

Building a Custom Plugin

A custom plugin is defined through an OpenAPI manifest that describes the API endpoints Security Copilot should call, the parameters it accepts, and the response format. The manifest includes semantic descriptions that help the AI understand when and how to use the plugin.

# Custom Plugin Manifest: Internal Threat Intel Feed
openapi: "3.0.0"
info:
  title: "Contoso Threat Intelligence"
  description: "Internal threat intel feed with IOCs,
    actor profiles, and campaign tracking."
  version: "1.0.0"
servers:
  - url: "https://threatintel.contoso.com/api/v1"
paths:
  /ioc/lookup:
    get:
      operationId: "lookupIOC"
      summary: "Look up an indicator of compromise"
      description: "Searches the internal threat
        intelligence database for information about
        a specific IOC (IP, domain, hash, URL)."
      parameters:
        - name: "indicator"
          in: "query"
          required: true
          schema:
            type: "string"
          description: "The IOC value to search for"
        - name: "type"
          in: "query"
          schema:
            type: "string"
            enum: ["ip", "domain", "hash", "url"]
      responses:
        "200":
          description: "IOC enrichment data"
  /campaigns/active:
    get:
      operationId: "getActiveCampaigns"
      summary: "List active threat campaigns"
      description: "Returns currently active threat
        campaigns targeting our organization."

Security Compute Units (SCUs): Pricing and Capacity

Security Copilot uses a consumption-based pricing model built around Security Compute Units (SCUs). Unlike seat-based licensing, SCUs represent processing capacity, meaning you pay for the compute resources consumed during AI-powered analysis rather than per-user. This model provides flexibility but requires careful capacity planning.

Understanding SCU Consumption

Capacity Planning Guidelines

SCUs are provisioned in units that you can scale up or down based on demand. Microsoft recommends starting with a baseline allocation and monitoring consumption patterns over the first 30 days. Key factors that influence SCU requirements include the size of your SOC team, the volume of incidents processed, and how extensively promptbooks and custom plugins are used.

// SCU Capacity Planning Framework

Small SOC (3-5 analysts)
  Baseline:    3 SCUs provisioned
  Use Cases:   Ad-hoc incident investigation
  Frequency:  10-20 sessions/day
  Budget:     Suitable for targeted adoption

Medium SOC (10-20 analysts)
  Baseline:    6-10 SCUs provisioned
  Use Cases:   Regular incident triage + threat hunting
  Frequency:  50-100 sessions/day
  Budget:     Monitor peaks during active incidents

Large SOC / MSSP (50+ analysts)
  Baseline:    15+ SCUs provisioned
  Use Cases:   Full SOC integration + automated workflows
  Frequency:  200+ sessions/day
  Budget:     Consider reserved capacity for predictability

Real-World Use Cases

Use Case 1: Accelerated Incident Response

A multinational enterprise detected suspicious activity on a Friday evening when only a junior analyst was on shift. Using Security Copilot, the analyst executed a pre-built incident investigation promptbook that automatically summarized the multi-stage attack, identified all compromised accounts, mapped the adversary’s lateral movement path, and generated containment recommendations. What would have required escalation to a senior analyst and hours of manual investigation was completed in under 15 minutes.

// Incident Response Workflow with Security Copilot

Phase 1: Detection & Triage (minutes 0-3)
  Prompt: "Summarize the latest high-severity incident
  and assess whether this is a true positive."
  → AI correlates alerts, confirms ransomware precursor activity

Phase 2: Scoping (minutes 3-7)
  Prompt: "Identify all entities connected to this
  incident. Map the lateral movement path and
  highlight any domain admin accounts involved."
  → Complete blast radius identified across 12 assets

Phase 3: Containment (minutes 7-10)
  Prompt: "Recommend containment actions. Which devices
  should be isolated and which accounts should be
  disabled to stop lateral movement?"
  → Prioritized containment actions generated

Phase 4: Communication (minutes 10-15)
  Prompt: "Generate an executive summary of this incident
  suitable for the CISO and legal team, including
  potential regulatory notification requirements."
  → Board-ready report produced automatically

Use Case 2: Proactive Threat Hunting

A threat intelligence team received an industry advisory about a new campaign targeting financial services. Using Security Copilot, they translated the advisory’s IOCs and TTPs into hunting queries across their Sentinel workspace, identified potential early indicators within their environment, and created detection rules to catch future variations of the attack.

Use Case 3: Compliance and Audit Reporting

During a SOC 2 audit, the security team needed to demonstrate their incident response capabilities and mean time to respond (MTTR) metrics. Security Copilot generated comprehensive reports from historical incident data, calculated response time metrics, and produced summaries of containment effectiveness across the audit period, reducing report preparation from days to hours.

Security Copilot Capabilities at a Glance

Security Copilot Across Microsoft Products

Security and Governance Considerations

Getting Started: Deployment Checklist

Deploying Security Copilot requires careful planning across licensing, infrastructure, and organizational readiness. Follow this checklist to ensure a smooth onboarding process.

1. Verify licensing prerequisites. Security Copilot requires Microsoft Entra ID P1 or P2 in your tenant, plus an active Azure subscription for SCU provisioning. Ensure your Microsoft 365 and Defender licensing tiers support the integration points you plan to use.
2. Provision Security Compute Units. Navigate to the Azure portal, create a Security Copilot resource, and provision your initial SCU allocation. Start with the minimum recommended for your SOC size and scale based on observed consumption.
3. Configure Entra ID roles. Assign the Security Copilot Owner role to your security engineering lead and Contributor roles to SOC analysts. Ensure Conditional Access policies allow access from SOC workstations and approved locations.
4. Enable Microsoft security product plugins. Activate the Defender XDR, Sentinel, Intune, Entra ID, and Purview plugins. Each plugin requires the appropriate product license and service connectivity. Validate data flow by running a test prompt against each product.
5. Connect third-party and custom plugins. If your SOC uses non-Microsoft tools, deploy the relevant third-party plugins or create custom OpenAPI-based plugins for internal data sources. Test authentication flows and response formats.
6. Build initial promptbooks. Convert your top five most common incident types into Security Copilot promptbooks. Test them against recent incidents to validate accuracy and completeness. Iterate based on analyst feedback.
7. Establish usage policies and governance. Define when analysts should use Security Copilot versus traditional methods, set SCU budget thresholds, and create guidelines for handling AI-generated outputs (human review requirements, confidence thresholds, escalation criteria).
8. Enable audit logging and monitoring. Route Security Copilot diagnostic logs to your Sentinel workspace. Create dashboards for SCU consumption, session activity, and adoption metrics. Set up alerts for unusual usage patterns.
9. Conduct SOC team training. Run tabletop exercises using Security Copilot for incident response scenarios. Train analysts on effective prompt engineering, promptbook creation, and the limitations of AI-generated analysis. Emphasize that AI outputs require human validation.
10. Measure and iterate. Track MTTR (mean time to respond), MTTI (mean time to investigate), and analyst satisfaction metrics before and after deployment. Use these baselines to demonstrate ROI and identify areas for workflow optimization.

Next Steps and Resources

Microsoft Security Copilot represents a fundamental shift in how security teams operate, moving from reactive alert processing to proactive, AI-augmented defense. The platform’s value compounds over time as your promptbook library grows, custom plugins mature, and analysts develop more sophisticated prompting strategies.

To deepen your expertise with Security Copilot, explore these paths:

• Microsoft Learn Security Copilot modules – Structured learning paths covering architecture, administration, and analyst workflows at Microsoft Learn
• Security Copilot Ninja Training – Microsoft’s advanced training program for security professionals, including hands-on labs and certification preparation
• Promptbook community library – Explore and share investigation workflows through the Security Copilot GitHub repository
• Plugin development documentation – Build custom integrations using the plugin SDK documentation
• Microsoft Defender XDR integration – Deep-dive into the embedded Security Copilot experience within Defender XDR