Lesson 32 — Automating Repetitive Investigations
Security Copilot, promptbooks, Sentinel automation rules and Logic Apps playbooks can reduce the repetitive work involved in common SOC investigations.
The goal is not to automate judgement. It is to automate predictable evidence collection, enrichment, formatting and documentation so analysts can spend more time understanding the incident.
This lesson explains how to identify safe automation candidates, insert review gates, handle failures and measure operational value without automating accountability.
What you will learn
This lesson develops a governed investigation-automation model for the SOC.
Investigation-automation workflow
↓
Identify frequent, predictable and low-risk tasks
↓
Define inputs, outputs and evidence requirements
↓
Select promptbook, automation rule, playbook or agent
↓
Add validation and approval gates
↓
Define failure, retry and manual fallback paths
↓
Test malicious, benign, incomplete and duplicate cases
↓
Review permissions, privacy and audit logging
↓
Deploy gradually to an approved analyst group
↓
Measure quality, time saved, overrides and failures
↓
Improve, version or retire the automation
Investigation-automation model
| Component | Content | Core question |
|---|---|---|
| Candidate | Frequent, predictable, low-ambiguity analyst task. | Should this step be automated? |
| Input | Incident, entity, source, time range and permissions. | What context is required? |
| Automation | Promptbook, automation rule, Logic App or approved agent. | Which mechanism fits the task? |
| Validation | Sources, identifiers, raw evidence, confidence and alternatives. | What must an analyst verify? |
| Action | Draft, enrichment, notification, response or escalation. | What may execute automatically? |
| Governance | Owner, permissions, testing, audit, version and retirement. | How will the workflow remain safe? |
Learning objectives
- Identify safe investigation-automation candidates.
- Separate assistance, automation and autonomous action.
- Use promptbooks, automation rules and playbooks appropriately.
- Add human review and approval gates.
- Handle failures, missing data and duplicates.
- Measure quality and operational outcomes.
- Preserve governance and analyst accountability.
What is investigation automation?
Investigation automation accelerates repeatable collection, enrichment, summarisation and reporting tasks while keeping analysts responsible for validation and decisions.
Automation is not autonomy
A workflow can automate defined steps without allowing the system to make unsupervised operational decisions.
Automate repetition
Good candidates are frequent, predictable tasks with stable inputs, clear outputs and low ambiguity.
Preserve accountability
The analyst remains responsible for incident classification, severity, containment, closure and reporting.
Start with the workflow
Document the current analyst process before deciding which steps should be automated.
Identify repeated steps
Look for tasks analysts perform in nearly every incident, such as summaries, entity collection and IOC enrichment.
Measure the current effort
Record handling time, repeated searches, missed steps, rework and handover quality.
Define the automation objective
State whether the workflow should save time, improve consistency, increase depth or reduce missed evidence.
Use clear entry criteria
Automation should begin only when the trigger and required inputs are present.
Use clear exit criteria
The workflow should show when it has completed, failed, paused for review or escalated.
Separate assisted and automated work
Some tasks should produce a draft for review, while others can execute safely after approval.
Human-in-the-loop
Require an analyst to validate evidence before the workflow advances into high-impact stages.
Human-on-the-loop
Use monitoring and exception review for low-risk, highly predictable automation.
Do not automate final verdicts
True-positive, compromised, contained and closed classifications require accountable analyst review.
Do not automate business impact
Operational, financial, customer and regulatory impact require business and evidence context.
Do not automate attribution
Threat-actor attribution should not be generated as an automatic incident verdict.
Do not automate legal conclusions
Legal, regulatory and notification decisions require authorised review.
Do not automate destructive actions blindly
Isolation, account disablement, token revocation and blocking need evidence and approval controls.
Incident-summary automation
Security Copilot can produce draft summaries from incident and alert context.
Validate incident summaries
Compare every material statement with source alerts, entities and timelines.
Entity-collection automation
Collect users, devices, mailboxes, files, IPs, domains, applications and resources.
Use immutable identifiers
Automated workflows should preserve stable IDs rather than relying only on display names.
Timeline automation
Copilot can organise events chronologically, but timestamps and relationships must be validated.
IOC-enrichment automation
Enrich IPs, domains, URLs, hashes and certificates with current context and internal sightings.
KQL-generation automation
Generate focused queries from repeatable hypotheses and known schemas.
KQL-validation gate
Require schema, filter, join and result review before query output affects conclusions.
ATT&CK-mapping automation
Suggest tactics and techniques based on observed behaviour while preserving confidence and evidence.
Malware-summary automation
Summarise suspicious files, scripts, commands and sandbox results without declaring compromise automatically.
Evidence-collection automation
Gather relevant alerts, entity pages, timelines, queries and threat-intelligence context.
Evidence preservation
Automation should record source, timestamp, identifier and collection method.
Executive-summary automation
Translate validated findings into a concise business-facing draft.
Shift-handover automation
Create structured handovers containing current status, completed actions, open questions and owners.
Case-note automation
Generate standard notes from validated investigation steps and actions.
Ticket-update automation
Update approved case-management fields while recording the source and automation identity.
Phishing investigation automation
Automate message summary, authentication review, URL and attachment enrichment and related-recipient searches.
Phishing review gate
Require analyst review before purge, block, user containment or incident closure.
Identity investigation automation
Automate sign-in summaries, MFA review, risk detections, session context and privilege changes.
Identity review gate
Require validation before password reset, token revocation or account disablement.
Endpoint investigation automation
Automate device summary, process-tree extraction, file context, persistence checks and network pivots.
Endpoint review gate
Require scope and business review before isolation, quarantine or live-response actions.
OAuth investigation automation
Automate application identity, publisher, permissions, consent, users and activity review.
OAuth review gate
Require approval before consent revocation, app disablement or credential removal.
Cloud investigation automation
Automate resource summary, alerts, attack paths, ownership, permissions and activity collection.
Cloud review gate
Require owner and change-control review before modifying production resources.
Threat-hunting automation
Automate hypothesis templates, query generation, result formatting and pivot suggestions.
Hunting review gate
Require analyst confirmation before turning hunt results into incidents or detections.
Use SOC promptbooks
Promptbooks can standardise repeated Security Copilot prompt sequences for common scenarios.
Use Sentinel automation rules
Automation rules can triage incidents, assign owners, change properties and invoke approved playbooks.
Use Sentinel playbooks
Logic Apps workflows can orchestrate notifications, enrichment, ticketing and response actions.
Keep promptbooks and playbooks distinct
Promptbooks organise generative prompts; Sentinel playbooks execute workflow actions.
Use agents carefully
Configured agents can support broader tasks but require permissions, scope, monitoring and governance.
Choose low-risk starting points
Begin with summaries, enrichment, evidence gathering and documentation.
Progress gradually
Move toward response automation only after accuracy, permissions and failure handling are proven.
Use least privilege
Automation identities, connectors and service principals should receive only the access required.
Use approval gates
High-impact actions should pause for authorised approval.
Use conditional branches
Route true-positive, benign, duplicate, incomplete and failed cases differently.
Use confidence thresholds carefully
Confidence can guide review priority but should not replace source validation.
Handle missing data
The workflow should identify unavailable connectors, empty tables and retention gaps.
Handle permission failures
Record when a plugin, connector or product cannot be accessed.
Handle partial completion
Show which stages succeeded, failed, skipped or require manual work.
Handle timeouts
Define retry, escalation and manual fallback behaviour.
Avoid silent failure
Every failure should be visible in the incident or operational log.
Avoid silent success
Record completed actions, identities, timestamps and outcomes.
Use idempotent design
Repeated execution should not create duplicate blocks, tickets, messages or changes.
Use test environments
Validate workflows against controlled incidents before production use.
Test malicious scenarios
Confirm the workflow collects enough evidence and reaches the correct review gate.
Test benign scenarios
Ensure normal administration does not cause unnecessary escalation.
Test incomplete scenarios
Check behaviour when key entities, logs or products are missing.
Test conflicting evidence
The workflow should preserve contradictions instead of forcing a verdict.
Test duplicate alerts
Confirm that repeated detections do not create duplicate response actions.
Test permission boundaries
Use different analyst roles to verify least-privilege behaviour.
Test business-critical assets
Ensure automation respects asset criticality and maintenance constraints.
Document every workflow
Record trigger, owner, inputs, outputs, permissions, actions, gates and fallback steps.
Assign an accountable owner
Every production automation needs an owner and backup owner.
Use version control
Track changes to prompts, connectors, logic, permissions and response actions.
Review after incidents
Lessons learned should improve branching, validation and failure handling.
Review after platform changes
Update automation when products, tables, APIs, permissions or portals change.
Retire unsafe automation
Disable workflows that rely on obsolete data, excessive permissions or unreliable logic.
Measure time saved
Compare analyst handling time before and after automation.
Measure consistency
Review whether required evidence and reporting sections are completed reliably.
Measure investigation depth
Determine whether automation helps analysts investigate more entities and data sources.
Measure rework
Track corrections, overrides, failed actions and repeated investigations.
Measure false escalation
Record how often automation creates unnecessary severity or response activity.
Measure missed evidence
Check whether important data is still omitted despite automation.
Measure analyst satisfaction
Ask whether automation reduces fatigue and improves decision quality.
Measure business outcomes
Evaluate containment speed, service impact, recurrence and incident quality.
Do not measure prompt volume alone
More prompts, runs or generated text do not necessarily improve security.
Monitor capacity use
Review Security Copilot capacity and workflow cost against operational value.
Protect sensitive data
Automation may process personal, confidential, customer or regulated information.
Limit output distribution
Send summaries and evidence only to approved destinations.
Audit automated activity
Record prompts, actions, identities, approvals, connectors and results.
Preserve human judgement
Automation should remove repetitive work so analysts can spend more time interpreting evidence.
Final analyst accountability
The authorised analyst remains responsible for every investigation conclusion and operational action.
Example repetitive-investigation automation
Automatic or assisted stages:
1. Summarise the message and incident
2. Collect sender, recipient, Network Message ID and delivery details
3. Enrich URLs, domains and attachment hashes
4. Search related recipients and messages
5. Check available user-click and endpoint evidence
6. Draft the incident timeline
7. Produce a validation checklist and response options
Required analyst gates:
• Confirm message identity and affected users
• Validate IOC freshness and internal sightings
• Review KQL results and raw evidence
• Approve purge, block or user containment
• Approve final classification and closure
Failure handling:
• Record missing plugins or permissions
• Mark unavailable telemetry
• Route unresolved evidence to manual investigation
Agent Foskett investigation: “The analyst who never skipped steps”
↓
Every analyst followed a slightly different method
↓
Some checked sender authentication
↓
Some checked endpoint activity
↓
Some searched related recipients
↓
Some stopped after reading the email
↓
The SOC introduced a reviewed Security Copilot workflow
↓
Every incident followed the same evidence sequence
↓
Summarise
↓
Validate
↓
Enrich
↓
Hunt
↓
Correlate
↓
Review
↓
Respond
↓
The analyst still made every decision
↓
The repetitive collection work disappeared
↓
Instead of spending twenty minutes gathering information
↓
The analyst spent twenty minutes understanding it
Investigation-automation validation checklist
| Area | Question | Validation action |
|---|---|---|
| Candidate | Is the task frequent, predictable and low ambiguity? | Document the manual workflow first. |
| Inputs | Are incident, entity and time-range inputs explicit? | Use stable identifiers. |
| Mechanism | Is promptbook, rule, playbook or agent appropriate? | Choose the least powerful sufficient option. |
| Evidence | Does the output preserve sources and raw records? | Require citations and identifiers. |
| Review | Where must an analyst approve progress? | Add human validation gates. |
| Permissions | Does the automation use least privilege? | Test connectors and identities. |
| Failure | What happens when data or an action fails? | Log status and provide manual fallback. |
| Testing | Has the workflow handled benign and incomplete cases? | Use controlled simulations. |
| Measurement | Does it improve time, consistency or depth? | Compare operational baselines. |
| Ownership | Who approves changes and outcomes? | Record owner, version and review date. |
Key takeaways
- Investigation automation should accelerate repetitive work rather than replace analyst judgement.
- Safe starting points include summaries, entity collection, enrichment, query drafting, timelines and reporting.
- Promptbooks, Sentinel automation rules and Logic Apps playbooks serve different operational purposes.
- High-impact response actions require evidence, least privilege and approval gates.
- Workflows should expose missing data, permission failures, partial completion and manual fallback paths.
- Idempotent design prevents duplicate tickets, blocks, notifications and response actions.
- Testing should include malicious, benign, incomplete, conflicting and duplicate scenarios.
- Success should be measured using time, quality, consistency, depth, rework and operational outcomes.
- Prompt volume and automation count do not prove security value.
- The authorised analyst remains accountable for the final investigation result.
What Agent Foskett automated
- Incident summary
- Entity collection
- IOC enrichment
- Related-message search
- User-click review
- Endpoint evidence draft
- Timeline draft
- Validation checklist
- Response options
- Shift handover
Best practices
- Automate repetition.
- Keep decisions human.
- Use stable identifiers.
- Add review gates.
- Apply least privilege.
- Handle failures visibly.
- Test benign cases.
- Measure quality.
- Version workflows.
- Preserve accountability.
Related Agent Foskett resources
Continue Module 4 — Operational Security Copilot
How do you automate repetitive investigations with Microsoft Security Copilot?
Security Copilot can accelerate repeated investigation tasks such as incident summaries, entity collection, IOC enrichment, KQL drafting, timeline creation and reporting while analysts validate evidence and approve decisions.
Security Copilot promptbooks and Microsoft Sentinel automation
Promptbooks organise sequential generative prompts, while Sentinel automation rules and Logic Apps playbooks orchestrate incident handling, notifications, enrichment and approved response actions.
Human review gates for SOC automation
Device isolation, account disablement, token revocation, email purge, indicator blocking and cloud changes should use evidence-based review and approval controls.
