Agent Foskett Academy • Microsoft Security Copilot
Microsoft Security Copilot Academy.
Security operations are no longer just about reading alerts one by one.
Modern security teams are expected to understand incidents quickly, connect evidence across tools, explain what happened and respond with confidence.
The Agent Foskett Microsoft Security Copilot Academy is designed to help learners use AI safely and effectively inside Microsoft security investigations, while still understanding the evidence, validating the output and applying human analyst judgement.
Learn how Microsoft Security Copilot helps security teams accelerate investigations, summarise incidents, generate hunting pivots and improve SOC workflows across Microsoft security platforms.
AI-assisted incident investigation
Prompt engineering for security
Incident summaries and evidence review
KQL assistance and analyst validation
What you will learn
This Academy will focus on practical Security Copilot concepts that help analysts investigate faster, ask better questions, validate AI-assisted output and use Microsoft security context responsibly.
AI-assisted investigationsUnderstand how Security Copilot can summarise incidents, explain alerts and help analysts move from evidence to investigation pivots faster.
Prompt engineering for securityLearn how to write focused security prompts, ask follow-up questions, request evidence and avoid vague or misleading AI responses.
PromptbooksLearn how promptbooks can standardise repeatable investigation workflows for phishing, identity compromise, endpoint alerts and cloud incidents.
Threat intelligence supportUse Copilot to summarise threat intelligence, explain attacker techniques and connect external context to internal security evidence.
KQL and hunting supportExplore how Security Copilot can help generate KQL ideas, explain queries and support hunting workflows while analysts validate every result.
Responsible analyst validationLearn why AI-assisted investigations still require human review, source validation, evidence checking and security judgement.
Planned learning path
The Microsoft Security Copilot Academy will grow into a structured path covering AI-assisted security fundamentals through to advanced promptbooks, investigation workflows and SOC enablement.
Foundation lessonsWhat is Microsoft Security Copilot, where it fits in the Microsoft security ecosystem and how analysts should think about AI-assisted investigations.
Incident summaries and evidence reviewHow to use Copilot to summarise incident evidence, identify key entities, explain alerts and produce investigation-ready notes.
Investigation workflowsUsing Copilot to triage phishing, identity compromise, endpoint alerts, OAuth abuse and cloud security incidents.
Threat intelligence supportUsing Copilot to summarise threat intelligence, explain attacker techniques and connect external context to internal evidence.
Promptbooks and automationBuilding repeatable promptbooks for phishing, compromised accounts, endpoint alerts, OAuth abuse and cloud investigations.
KQL and Defender XDR supportUsing Copilot alongside Defender XDR, Sentinel, Entra, endpoint telemetry and KQL hunting workflows.
Related Agent Foskett Academies
Security Copilot connects naturally with every Microsoft security academy because it sits across investigation, hunting, response and reporting.
Microsoft Sentinel AcademySentinel provides SIEM, SOAR, incident management and hunting workflows that Security Copilot can help analysts reason through.
Microsoft Entra Security AcademyIdentity, access, risky sign-ins and account compromise investigations are strong candidates for Security Copilot-assisted workflows.
Defender for Endpoint AcademyEndpoint telemetry gives Security Copilot rich evidence for process, file, network and device-level investigation summaries.
Final thought
Security Copilot is not a replacement for the analyst. It is a force multiplier for analysts who understand the evidence, ask better questions and validate what the AI returns.
Agent Foskett mindsetDo not treat AI output as evidence by itself. Use Security Copilot to accelerate the investigation, then validate the source data, timeline and conclusions.
Launching soonThis Academy will expand with practical Security Copilot lessons, promptbooks, incident investigation workflows and AI-assisted SOC guidance.
Develop IT. Protect IT.GEMXIT PTY LTD | GEMXIT UK LTD
Microsoft Security Copilot Academy
The Agent Foskett Microsoft Security Copilot Academy teaches AI-assisted security investigations, prompt engineering, promptbooks, incident summaries, KQL support, threat intelligence workflows and responsible analyst validation.
Learn Microsoft Security Copilot
Microsoft Security Copilot helps security teams accelerate investigations, summarise evidence, reason across Microsoft security signals and improve SOC workflows using AI-assisted analysis.
Microsoft Security Copilot training for security analysts
This Academy supports learners working with Microsoft Security Copilot, Defender XDR, Microsoft Sentinel, Microsoft Entra, KQL hunting, prompt engineering, promptbooks and AI-assisted incident response.
