Lesson 1 — What is Microsoft Security Copilot?
Microsoft Security Copilot is an AI-powered security solution designed to help security and IT professionals investigate threats, understand security signals, assess risk and work through complex security information more quickly.
It can summarise incidents, explain alerts, support threat intelligence, help develop KQL queries and suggest investigation pivots across Microsoft security products.
But Security Copilot does not replace the analyst. The analyst still validates the evidence, understands the business context and decides what action should be taken.
What you will learn
This lesson introduces Security Copilot and the evidence-first mindset used throughout the Academy.
Microsoft Security Copilot investigation model
↓
Microsoft Defender XDR, Sentinel, Entra, Defender for Cloud and other connected products
↓
Analyst asks a natural-language security question
↓
Security Copilot processes available context through connected capabilities and plugins
↓
Copilot returns a summary, explanation, suggested query or investigation pivot
↓
Analyst reviews the cited sources and underlying evidence
↓
Facts are separated from assumptions and uncertainty
↓
The analyst decides the next investigation or response action
Security Copilot at a glance
| Area | What Security Copilot provides | What the analyst still provides |
|---|---|---|
| Interaction | Natural-language prompts and follow-up questions. | Clear objectives, scope and investigation context. |
| Incident review | Summaries of alerts, entities and possible attack activity. | Validation against original alerts, logs and timelines. |
| Threat intelligence | Explanations of threat actors, indicators and techniques. | Relevance to the organisation and current incident. |
| KQL support | Query generation, explanation and refinement assistance. | Schema knowledge, testing and result validation. |
| Reporting | Draft technical and executive summaries. | Accuracy, confidence, impact and final approval. |
| Response | Suggested next steps and investigation pivots. | Risk decisions, containment approval and accountability. |
Learning objectives
- Define Microsoft Security Copilot.
- Understand why it was created.
- Recognise standalone and embedded experiences.
- Identify common security use cases.
- Understand its relationship with Microsoft security products.
- Recognise the limits of AI-assisted output.
- Apply evidence-first analyst validation.
What is Microsoft Security Copilot?
Microsoft Security Copilot is a generative AI security solution built for security and IT professionals.
Natural-language security analysis
Analysts can ask questions using everyday language instead of beginning every investigation with a portal search or manually written query.
Built for security work
Security Copilot is designed for security operations, incident response, threat intelligence, posture, identity and IT administration scenarios.
Why Security Copilot was created
Security teams face high alert volumes, fragmented evidence, complex attacks and pressure to investigate quickly.
The problem is not always missing data
Many investigations already contain enough evidence. The challenge is connecting it across identities, devices, email, cloud resources and threat intelligence.
Faster initial understanding
Security Copilot can help turn a collection of alerts and entities into an initial explanation of what may have happened.
Standalone experience
The standalone Security Copilot experience provides a dedicated workspace for prompts, sessions, promptbooks and connected security capabilities.
Embedded experiences
Security Copilot capabilities can also appear inside supported Microsoft security products, allowing analysts to use AI in the workflow they are already investigating.
Microsoft Defender XDR
Security Copilot can help summarise incidents, explain alerts, review entities and support cross-domain investigations.
Microsoft Sentinel
Security Copilot can assist with incident investigation, threat hunting, KQL development and security operations workflows.
Microsoft Entra
Identity investigations may include risky sign-ins, suspicious authentication, privilege changes and compromised-account activity.
Microsoft Defender for Cloud
Cloud investigations may include resources, recommendations, attack paths, workload alerts and exposure context.
Microsoft Intune
Security Copilot can support device-management and endpoint-administration scenarios where supported capabilities are available.
Microsoft Purview
Security Copilot can support data-security, compliance and investigation scenarios through connected Microsoft capabilities.
Threat intelligence
Copilot can summarise threat actors, campaigns, indicators, tactics and techniques to provide external context.
Incident summaries
Copilot can organise alerts, entities and important events into a concise starting point for an investigation.
Alert explanations
Security Copilot can explain unfamiliar alert names, behaviours, terminology and relationships.
Investigation pivots
Copilot can suggest useful entities, questions and evidence sources for the analyst to investigate next.
Timeline assistance
AI can help arrange events chronologically, but the analyst must confirm timestamps and relationships.
KQL generation support
Security Copilot can help draft queries, but every table, field, filter and returned result must be checked.
KQL explanation
Copilot can explain what an unfamiliar query is attempting to do and identify possible investigation logic.
Promptbooks
Promptbooks organise repeatable sequences of prompts for common security workflows and investigations.
Plugins
Plugins connect Security Copilot to supported Microsoft and third-party capabilities and provide data or actions for prompts.
Grounded responses
Useful responses depend on the context, permissions, plugins and data available to the current user and session.
Permissions still matter
Security Copilot does not automatically give an analyst access to security data they are not authorised to view.
Business context matters
An AI response may identify suspicious behaviour without understanding whether that behaviour is expected in the organisation.
AI output is not evidence
A fluent explanation can still be incomplete, incorrect or based on a weak assumption.
Review cited sources
Analysts should inspect the alerts, entities, logs, threat intelligence and product sources used to produce a response.
Separate fact from inference
Record which conclusions are confirmed, likely, possible or unsupported.
Check the timeline
Confirm that timestamps create a credible sequence and that events are not being connected only because they look similar.
Check the entities
Verify that users, devices, IP addresses, mailboxes, applications and cloud resources belong to the same investigation.
Check the scope
Determine whether the activity affects one account or a broader group of users, devices and resources.
Check uncertainty
Ask Copilot to identify missing data, conflicting evidence and conclusions that cannot be verified.
Human judgement remains essential
The analyst decides whether an incident is genuine, how serious it is and what response is appropriate.
Security Copilot is a force multiplier
It helps capable analysts move faster, but it does not replace security knowledge or investigation discipline.
Example introductory prompt
Identify:
1. The likely initial access method
2. The affected users and devices
3. The most important evidence
4. Any gaps or uncertainty
5. The next three investigation steps
Separate confirmed facts from assumptions.
Agent Foskett investigation: “The incident contained fourteen alerts…”
↓
Three endpoints
↓
Two identities
↓
One suspicious email
↓
A malicious URL click
↓
A PowerShell download
↓
An impossible-travel alert
↓
An OAuth consent request
↓
Every alert made sense by itself
↓
Together they appeared to describe a larger attack
↓
Agent Foskett asked Security Copilot for an incident summary
↓
Copilot proposed a likely phishing-led attack path
↓
Agent Foskett did not accept the answer as evidence
↓
He reviewed the email, sign-ins, endpoint timeline and OAuth activity
↓
Some events were confirmed
↓
One alert belonged to unrelated administration activity
↓
The final attack path was narrower than the AI summary
↓
Security Copilot accelerated the investigation
↓
Evidence closed the case
Security Copilot validation checklist
| Validation area | Question to ask | Evidence to review |
|---|---|---|
| Source | What data supports this claim? | Alerts, logs, entities, plugins and cited sources. |
| Timeline | Do the events occur in a credible order? | Event timestamps and investigation timeline. |
| Identity | Is the correct user or service identity involved? | Sign-in, audit, role and risk activity. |
| Device | Is the activity linked to the correct endpoint? | Device timeline, processes, files and network connections. |
| Was the message delivered and interacted with? | EmailEvents, UrlClickEvents and mailbox evidence. | |
| Cloud | Are the affected resources and permissions connected? | Resource, identity, alert and attack-path evidence. |
| Scope | Is this isolated or widespread? | Related users, devices, resources and indicators. |
| Context | Could legitimate activity explain the behaviour? | Change records, owners and business operations. |
| Confidence | Is the conclusion confirmed or inferred? | Supporting and conflicting evidence. |
| Action | Is there enough verified evidence to respond? | Risk, impact, containment options and approvals. |
Key takeaways
- Microsoft Security Copilot is a generative AI security solution for security and IT professionals.
- Analysts interact with it using natural-language prompts and follow-up questions.
- Security Copilot can help summarise incidents, explain alerts, support threat intelligence and assist with KQL.
- It is available through standalone and embedded experiences.
- It works alongside Microsoft security products rather than replacing them.
- Permissions, connected capabilities and available context influence the response.
- AI output may be incomplete or incorrect even when it sounds convincing.
- Analysts must review sources, timelines, entities, scope and business context.
- Human judgement remains responsible for conclusions and response actions.
- AI accelerates the investigation. Evidence closes the case.
What Agent Foskett checked
- Incident summary
- Source evidence
- Alert relationships
- User identities
- Endpoint activity
- Email evidence
- Cloud resources
- Timeline accuracy
- Unsupported assumptions
- Remaining uncertainty
Best practices
- Ask focused questions.
- Provide useful context.
- Request supporting evidence.
- Separate fact from inference.
- Review cited sources.
- Confirm timelines and entities.
- Protect sensitive information.
- Use least privilege.
- Document confidence and uncertainty.
- Keep the analyst accountable.
Related Agent Foskett resources
Continue the Microsoft Security Copilot Academy
What is Microsoft Security Copilot?
Microsoft Security Copilot is a generative AI security solution designed to help security and IT professionals investigate threats, process security signals, assess risk and work across Microsoft security products using natural-language prompts.
Microsoft Security Copilot Lesson
This Agent Foskett lesson introduces Security Copilot, standalone and embedded experiences, incident summaries, alert explanations, threat intelligence, KQL support, plugins and evidence-first analyst validation.
