Back to Details

security-copilot

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Microsoft Security Copilot

Microsoft Security Copilot

Microsoft Security Copilot is a generative-AI security platform that helps security and IT teams investigate incidents, hunt threats, summarise findings, and respond at machine speed using natural language, grounded in your security data and Microsoft threat intelligence.
Microsoft Security Copilot是一款生成式AI安全平台，依托您的安全数据和微软威胁情报，通过自然语言帮助安全与IT团队以机器速度调查事件、狩猎威胁、总结发现并做出响应。

When to use

适用场景

Accelerating SOC investigation, reporting, and analyst productivity across Microsoft and third-party security data using natural-language workflows.
Do not use this skill for:
  • Configuring autonomous triage/remediation agents (use 
    security-copilot-agents
    )
  • Building a SIEM analytics rule (use 
    sentinel
    )
  • Configuring Defender XDR investigations or actions (use 
    defender-xdr
    )
通过自然语言工作流提升SOC调查、报告效率以及分析师生产力，覆盖微软及第三方安全数据场景。
请勿将本技能用于：
  • 配置自动分诊/修复Agent（请使用
    security-copilot-agents
    ）
  • 构建SIEM分析规则（请使用
    sentinel
    ）
  • 配置Defender XDR调查或操作（请使用
    defender-xdr
    ）

Pick the right experience for the task

为任务选择合适的体验

TaskUse this experienceWhy
Multi-step investigation across productsStandalone portalCross-plugin reasoning, promptbooks
Summarise this specific incidentEmbedded in Defender XDRContext already loaded
Explain or translate a KQL queryEmbedded in SentinelInline in the query editor
Explain a Conditional Access policyEmbedded in EntraPolicy already in scope
Repeatable investigation patternPromptbookSaved, shareable, parameterised
Daily ad-hoc analyst questionStandalone or embeddedEither; pick by where you start
Rule of thumb: start embedded for single-product questions, switch to standalone the moment you need to correlate across two or more products. Promptbook anything you do more than twice.
任务使用对应体验原因
跨产品多步骤调查独立门户跨插件推理、Promptbook支持
总结特定事件Defender XDR嵌入式体验上下文已加载
解释或转换KQL查询Sentinel嵌入式体验集成于查询编辑器内
解释条件访问策略Entra嵌入式体验策略已处于作用域内
可重复的调查模式Promptbook可保存、共享、参数化
分析师日常临时问题独立或嵌入式体验均可；根据起始场景选择
经验法则： 针对单一产品问题，从嵌入式体验开始；当需要关联两个或更多产品时，切换到独立体验。对于重复两次以上的操作，使用Promptbook。

Approach

实施步骤

  1. Provision capacity - Set up Security Compute Units (SCUs) in Azure (provisioned capacity model), assign the Azure subscription and resource group, choose the geographic region, and configure overage settings. SCUs are the meter; underprovisioning throttles, overprovisioning wastes spend. Verify: Security Copilot → Owner settings → Capacity shows SCUs reserved and the region matches your data residency requirement.
  2. Assign roles - Configure Security Copilot owner and contributor roles in Entra, align to least privilege, set the default environment, and decide on the data sharing toggle (model improvement opt-in/out). Verify: a non-owner test account can use Copilot but cannot change capacity settings.
  3. Enable plugins - Turn on the Microsoft plugins you need (Defender XDR, Sentinel, Intune, Entra, Threat Intelligence, Purview, Defender for Cloud) and add non-Microsoft or custom plugins where you have third-party data. Copilot respects the underlying product RBAC of the calling user - it never elevates privilege. Verify: a query that requires Sentinel data from a user without Sentinel access returns a permission error, not an answer.
  4. Choose the experience per workflow - Use the standalone portal for multi-step cross-product investigations, and the embedded experiences inside Defender XDR, Sentinel, Intune, Entra, and Purview for single-product context. Verify: analysts know which surface to start in for their top 5 daily tasks.
  5. Build promptbooks - Identify your top 5 repeatable workflows (incident summary for exec, reverse-engineer a script, KQL explanation, phishing email triage, CA policy explanation) and turn each into a promptbook with parameters. Verify: each promptbook runs end-to-end on a sample input without manual editing.
  6. Govern usage and consumption - Monitor SCU consumption per workload, audit Copilot activity, and set alerts on SCU utilisation > 80% to control cost. Review prompt logs for sensitive data exposure. Verify: a usage dashboard exists; alerting fires when SCUs trend high.
  7. Measure value - Track time-to-first-answer, analyst satisfaction, and SCU per resolved incident before and after rollout. If the metric does not move, the promptbooks or plugins are wrong, not the platform.
  1. 配置容量 - 在Azure中设置安全计算单元（SCU）（预配置容量模型），分配Azure订阅和资源组，选择地理区域，配置超额使用设置。SCU是计量单位；配置不足会导致限流，配置过多会浪费成本。 验证：Security Copilot → 所有者设置 → 容量页面显示预留的SCU，且区域符合您的数据驻留要求。
  2. 分配角色 - 在Entra中配置Security Copilot的所有者和贡献者角色，遵循最小权限原则，设置默认环境，并决定数据共享开关（是否选择加入模型改进）。 验证：非所有者测试账户可使用Copilot，但无法更改容量设置。
  3. 启用插件 - 开启所需的微软插件（Defender XDR、Sentinel、Intune、Entra、威胁情报、Purview、Defender for Cloud），并在拥有第三方数据的情况下添加非微软或自定义插件。Copilot遵循调用用户的底层产品RBAC权限——它绝不会提升权限。 验证：无Sentinel访问权限的用户发起需要Sentinel数据的查询时，返回权限错误而非答案。
  4. 为每个工作流选择对应体验 - 使用独立门户进行多步骤跨产品调查，在Defender XDR、Sentinel、Intune、Entra和Purview内使用嵌入式体验处理单一产品上下文场景。 验证：分析师清楚针对日常前5项任务应从哪个界面开始。
  5. 构建Promptbook - 识别您的前5个可重复工作流（为高管总结事件、逆向工程脚本、KQL查询解释、钓鱼邮件分诊、CA策略解释），并将每个工作流转换为带参数的Promptbook。 验证：每个Promptbook在示例输入下可端到端运行，无需手动编辑。
  6. 管控使用与消耗 - 按工作负载监控SCU消耗，审计Copilot活动，并设置SCU利用率>80%时的警报以控制成本。检查提示日志是否存在敏感数据泄露情况。 验证：存在使用情况仪表板；当SCU使用率偏高时触发警报。
  7. 衡量价值 - 在部署前后跟踪首次响应时间、分析师满意度以及每解决一起事件的SCU消耗。如果指标没有变化，问题出在Promptbook或插件，而非平台本身。

Guardrails

防护规则

  • Treat AI output as assistive - analysts must validate findings before acting. Copilot is not the source of truth; the underlying product is.
  • Apply least-privilege plugin access; Copilot inherits the user's product RBAC, so over- permissioning a user over-permissions Copilot for that user.
  • Monitor SCU consumption to control cost; tune capacity to demand and set utilisation alerts. Surprises in capacity bills are a configuration problem, not a platform problem.
  • Data residency is set at capacity creation - changing region later means rebuild. Decide up front based on regulatory scope.
  • Sensitive prompts are still data. Treat the prompt history as audit-relevant; do not paste credentials, customer PII, or unsanitised raw data into prompts.
  • Promptbooks are code. Version-control them, review changes, and remove unused ones.
  • 将AI输出视为辅助信息——分析师在采取行动前必须验证结果。Copilot不是事实来源；底层产品才是。
  • 应用最小权限插件访问；Copilot继承用户的产品RBAC权限，因此给用户过度授权会导致Copilot对该用户的权限也过度。
  • 监控SCU消耗以控制成本；根据需求调整容量并设置利用率警报。容量账单出现意外是配置问题，而非平台问题。
  • 数据驻留在容量创建时设置——后续更改区域意味着需要重建。请根据监管范围提前决定。
  • 敏感提示仍属于数据。将提示历史视为审计相关内容；请勿在提示中粘贴凭据、客户PII或未清理的原始数据。
  • Promptbook属于代码。对其进行版本控制、审核变更，并移除未使用的Promptbook。

Common anti-patterns

常见反模式

  • "Buy SCUs, give everyone access, see what happens." Burns budget, produces no measurable value, and trains analysts to distrust AI output.
  • Skipping promptbooks. Without them, every investigation is a snowflake and the platform feels like a chatbot, not a workflow.
  • Treating Copilot as a fact source. It synthesises from the products' data - if the data is wrong, the answer is wrong. Always pivot to the source product for action.
  • Pasting raw incident data into the standalone prompt when the embedded experience already has it. Wastes SCUs and adds risk.
  • No SCU utilisation alerts. First sign of a problem is the invoice.
  • “购买SCU，给所有人权限，看看效果。” 浪费预算，无法产生可衡量的价值，还会让分析师对AI输出产生不信任。
  • 跳过Promptbook。没有Promptbook，每次调查都是孤立事件，平台感觉更像聊天机器人而非工作流工具。
  • 将Copilot视为事实来源。它从产品数据中进行综合——如果数据错误，答案也会错误。始终转向源产品采取行动。
  • 当嵌入式体验已包含原始事件数据时，仍将其粘贴到独立提示中。浪费SCU并增加风险。
  • 未设置SCU利用率警报。问题的第一个迹象就是账单。

Example prompts

示例提示

  • Set up Microsoft Security Copilot and provision SCUs.
  • Use promptbooks to summarise an incident for a stakeholder.
  • How do I use AI to speed up incident investigation in my SOC?
  • Explain a KQL query with Security Copilot.
  • Pick between standalone and embedded experiences for my analysts.
  • Set up Microsoft Security Copilot and provision SCUs.
  • Use promptbooks to summarise an incident for a stakeholder.
  • How do I use AI to speed up incident investigation in my SOC?
  • Explain a KQL query with Security Copilot.
  • Pick between standalone and embedded experiences for my analysts.

Microsoft Learn

Microsoft Learn