security-copilot

name	security-copilot
description	Guidance for Microsoft Security Copilot - the generative-AI security platform that helps analysts investigate, hunt, summarise, and respond using natural language, plugins, promptbooks, and embedded experiences. Covers SCU provisioning, plugins, promptbooks, governance, and the standalone vs embedded experience choice. WHEN: Microsoft Security Copilot, AI for SOC, security copilot units SCU, promptbooks, Copilot plugins, natural language investigation, summarise incident with AI, Copilot for Security setup, how do I use AI in my SOC, explain a KQL query with AI, summarise an alert for a stakeholder. DO NOT USE when the goal is configuring autonomous triage or remediation agents (use security-copilot-agents).
license	MIT
metadata	{"author":"Microsoft","version":"0.1.0"}

Microsoft Security Copilot

Microsoft Security Copilot is a generative-AI security platform that helps security and IT teams investigate incidents, hunt threats, summarise findings, and respond at machine speed using natural language, grounded in your security data and Microsoft threat intelligence.

When to use

Accelerating SOC investigation, reporting, and analyst productivity across Microsoft and third-party security data using natural-language workflows.

Do not use this skill for:

• Configuring autonomous triage/remediation agents (use security-copilot-agents)
• Building a SIEM analytics rule (use sentinel)
• Configuring Defender XDR investigations or actions (use defender-xdr)

Pick the right experience for the task

Task	Use this experience	Why
Multi-step investigation across products	Standalone portal	Cross-plugin reasoning, promptbooks
Summarise this specific incident	Embedded in Defender XDR	Context already loaded
Explain or translate a KQL query	Embedded in Sentinel	Inline in the query editor
Explain a Conditional Access policy	Embedded in Entra	Policy already in scope
Repeatable investigation pattern	Promptbook	Saved, shareable, parameterised
Daily ad-hoc analyst question	Standalone or embedded	Either; pick by where you start

Rule of thumb: start embedded for single-product questions, switch to standalone the moment you need to correlate across two or more products. Promptbook anything you do more than twice.

Approach

1. Provision capacity - Set up Security Compute Units (SCUs) in Azure (provisioned capacity model), assign the Azure subscription and resource group, choose the geographic region, and configure overage settings. SCUs are the meter; underprovisioning throttles, overprovisioning wastes spend. Verify: Security Copilot → Owner settings → Capacity shows SCUs reserved and the region matches your data residency requirement.
2. Assign roles - Configure Security Copilot owner and contributor roles in Entra, align to least privilege, set the default environment, and decide on the data sharing toggle (model improvement opt-in/out). Verify: a non-owner test account can use Copilot but cannot change capacity settings.
3. Enable plugins - Turn on the Microsoft plugins you need (Defender XDR, Sentinel, Intune, Entra, Threat Intelligence, Purview, Defender for Cloud) and add non-Microsoft or custom plugins where you have third-party data. Copilot respects the underlying product RBAC of the calling user - it never elevates privilege. Verify: a query that requires Sentinel data from a user without Sentinel access returns a permission error, not an answer.
4. Choose the experience per workflow - Use the standalone portal for multi-step cross-product investigations, and the embedded experiences inside Defender XDR, Sentinel, Intune, Entra, and Purview for single-product context. Verify: analysts know which surface to start in for their top 5 daily tasks.
5. Build promptbooks - Identify your top 5 repeatable workflows (incident summary for exec, reverse-engineer a script, KQL explanation, phishing email triage, CA policy explanation) and turn each into a promptbook with parameters. Verify: each promptbook runs end-to-end on a sample input without manual editing.
6. Govern usage and consumption - Monitor SCU consumption per workload, audit Copilot activity, and set alerts on SCU utilisation > 80% to control cost. Review prompt logs for sensitive data exposure. Verify: a usage dashboard exists; alerting fires when SCUs trend high.
7. Measure value - Track time-to-first-answer, analyst satisfaction, and SCU per resolved incident before and after rollout. If the metric does not move, the promptbooks or plugins are wrong, not the platform.

Guardrails

• Treat AI output as assistive - analysts must validate findings before acting. Copilot is not the source of truth; the underlying product is.
• Apply least-privilege plugin access; Copilot inherits the user's product RBAC, so over- permissioning a user over-permissions Copilot for that user.
• Monitor SCU consumption to control cost; tune capacity to demand and set utilisation alerts. Surprises in capacity bills are a configuration problem, not a platform problem.
• Data residency is set at capacity creation - changing region later means rebuild. Decide up front based on regulatory scope.
• Sensitive prompts are still data. Treat the prompt history as audit-relevant; do not paste credentials, customer PII, or unsanitised raw data into prompts.
• Promptbooks are code. Version-control them, review changes, and remove unused ones.

Common anti-patterns

• "Buy SCUs, give everyone access, see what happens." Burns budget, produces no measurable value, and trains analysts to distrust AI output.
• Skipping promptbooks. Without them, every investigation is a snowflake and the platform feels like a chatbot, not a workflow.
• Treating Copilot as a fact source. It synthesises from the products' data - if the data is wrong, the answer is wrong. Always pivot to the source product for action.
• Pasting raw incident data into the standalone prompt when the embedded experience already has it. Wastes SCUs and adds risk.
• No SCU utilisation alerts. First sign of a problem is the invoice.

Example prompts

• Set up Microsoft Security Copilot and provision SCUs.
• Use promptbooks to summarise an incident for a stakeholder.
• How do I use AI to speed up incident investigation in my SOC?
• Explain a KQL query with Security Copilot.
• Pick between standalone and embedded experiences for my analysts.

Microsoft Learn

• Overview: https://learn.microsoft.com/security-copilot/microsoft-security-copilot
• Get started / provision SCUs: https://learn.microsoft.com/security-copilot/get-started-security-copilot
• Plugins: https://learn.microsoft.com/security-copilot/manage-plugins
• Promptbooks: https://learn.microsoft.com/security-copilot/using-promptbooks
• Manage usage and capacity: https://learn.microsoft.com/security-copilot/manage-usage
• Authentication and access: https://learn.microsoft.com/security-copilot/authentication