Security Copilot & Defender: AI Agents for SOC

Security Copilot in Microsoft Defender: Autonomous AI for SOC Operations

The evolution of modern Security Operations Centers (SOC) demands detection and response capabilities operating at machine speed. Microsoft Security Copilot, natively integrated into the Microsoft Defender XDR portal, introduces a new generation of autonomous AI agents capable of triaging, investigating and contextualizing threats without systematic human intervention. This article deconstructs the architecture, technical prerequisites and operational use cases of the four agents deployed in Defender, for security engineers and SOC administrators.

General Architecture: The Four Security Copilot Agents in Defender

Security Copilot agents are deployed within the security.microsoft.com portal via the Security Copilot > Agents panel. Each agent has its own managed identity (Agent ID), specific plugins and dedicated RBAC permissions. The platform also supports third-party agents and custom agents (via REST API, KQL, Logic Apps or MCP servers).

Agent 1: Phishing Triage Agent

Prerequisites and Configuration

The Phishing Triage Agent is the most mature autonomous agent in the Defender ecosystem. Its triggering relies exclusively on the User Reported Phish mechanism: when a user right-clicks an email and selects "Report as phishing", this automatically triggers the agent.

Agent ID: Agent Identity Security and Governance

The Agent ID is a fundamental architectural concept introduced with autonomous Security Copilot agents. It is a managed identity (Managed Identity) registered in Microsoft Entra ID, representing the agent as a security principal. This approach offers several critical advantages:

• Reduced blast radius: permissions are strictly limited to the agent's functional scope
• Workload-based permissions
• Conditional Access policies applied to agent identity
• Complete auditability of actions via Entra ID logs

Custom and Third-Party Plugins

The Security Copilot platform supports three plugin categories:

• Microsoft first-party plugins: Defender XDR, Threat Intelligence, Entra, Intune, Purview
• Third-party plugins: available via the Security Store (security.microsoft.com > Security Copilot > Browse more agents)
• Custom plugins: developable from a REST API, KQL query, Logic App or MCP server (Model Context Protocol)

Operational Functioning and Workflow Analysis

When a user reports an email, the agent completes the following steps in less than 4 minutes:

1. Auto-assignment of the alert and investigation start
2. Memory consultation (historical analyst feedback)
3. Raw email content parsing (headers, metadata)
4. Authentication record analysis: SPF, DMARC, DKIM
5. Source IP address investigation (reputation, geolocation)
6. Email detonation in a sandboxed environment
7. Phishing simulation verification (Attack Simulator — simulation emails do not trigger false positives)
8. Sentiment and urgency analysis of the message
9. Screenshot capture and visual content analysis
10. Final verdict: True Positive (TP), False Positive (FP), or escalation to analyst

Performance Dashboard: Key Metrics

The agent's Performance panel exposes the following indicators:

• Total submissions over 30 and 90 days
• Incidents addressed vs total (TPs not resolved automatically remain open for analyst)
• Mean Time to Triage (MTTT): approximately 3 minutes 5 seconds on average
• Security Compute Units (SCU) consumption: approximately 0.12 to 0.15 SCU per execution

Filtering Incidents Triaged by the Agent in Defender

To isolate incidents handled by the Phishing Triage Agent in the incidents view:

1Portal: security.microsoft.com > Investigations > Incidents & Alerts > Incidents
2Filter by: Tags = "Agent"

Triaged incidents automatically receive two tags:

• agent (generic tag indicating autonomous processing)
• credential phishing (or corresponding classification)

Learning from Feedback and Custom Guidebooks

One of the most strategic features is the agent's ability to learn from analyst feedback. When an analyst changes a verdict classification (TP → FP or FP → TP), the agent analyzes the associated comment and updates its memory for future investigations.

Custom Guidebooks allow customization of triage steps recommended by Security Copilot. To deploy them:

Analyst Notes: Automated Incident Documentation

The Analyst Notes feature allows Security Copilot to automatically draft a structured investigation report while an analyst works on a parallel incident. The generated report contains:

• Executive summary of the incident
• Description of detected alerts
• Investigation steps performed (built-in + custom guidebook)
• Conclusion and recommendations

This facilitates handoffs between analysts (shift changes) and post-incident documentation without added writing burden.

Roadmap: Extension to Identity-Based Alerts

Announced at Microsoft Ignite, the next evolution of the Phishing Triage Agent will include support for identity-based alerts:

• Binary drift detections in Microsoft Defender for Cloud (Kubernetes alerts)
• Microsoft Entra ID risk detections (users synchronized from the cloud)
• Hybrid identity alerts

Agent 2: Threat Intelligence Briefing Agent

The Threat Intel Briefing Agent automatically generates a personalized threat intelligence report for your tenant, accessible directly from security.microsoft.com > Threat Intelligence > Threat Analytics.

What This Agent Produces

Unlike generic threat intelligence reports, this agent correlates Microsoft Threat Intelligence global data with:

• The industry configured when deploying the agent
• Active CVEs impacting equipment in your tenant
• EASM (External Attack Surface Management) data
• Indicators of Compromise (IoCs) relevant to your environment

The produced report contains an executive summary adapted for CISOs and leadership teams, as well as direct links to the Advanced Hunting portal with pre-generated KQL queries to investigate impacted devices.

Link Between Threat Intel and Threat Hunting

The Threat Intel Briefing Agent's report provides a natural bridge to active investigation: each CVE mentioned in the report can be directly clicked to view details, then forwarded to Advanced Hunting with a KQL query targeting vulnerable devices in your tenant.

Agent 3: Threat Hunting Agent

The Threat Hunting Agent is accessible from security.microsoft.com > Investigations > Hunting > Advanced Hunting. It appears as a Copilot panel integrated into the existing Advanced Hunting interface.

Natural Language KQL Generation

The agent translates natural language queries into optimized KQL (Kusto Query Language) queries. Example interaction:

1NLP Query: "List all active Windows 7 or Windows 10 devices in the environment"

The agent automatically generates the corresponding KQL query, executes it and presents results with visualizations. It then suggests contextualized next investigation steps.

1// Example query generated by the Threat Hunting Agent
2DeviceInfo
3| where OSPlatform has_any ("Windows 7", "Windows 10")
4| where Timestamp > ago(7d)
5| summarize LastSeen = max(Timestamp), Count = count() by DeviceName, OSPlatform, OSVersion
6| order by LastSeen desc

Interactive Investigation Workflow

The agent supports multi-turn conversational investigation sessions:

1. Initial question → KQL generation + execution + results
2. Refinement → "Now, list recent security alerts for these specific devices"
3. Contextualization → agent generates new KQL query accounting for previous results
4. Recommendations → list of remediation or supplementary investigation actions

Agent 4: Dynamic Threat Detection Agent

The Dynamic Threat Detection Agent is the most innovative of the quartet. It operates 24/7 in the background, without required configuration, and is currently in Public Preview.

Operation: Blind Spot Detection

This agent continuously analyzes all available signals in your Defender XDR environment:

• SIEM/SOAR data: Microsoft Sentinel (formerly Azure Sentinel)
• First-party XDR signals: Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps
• Third-party XDR signals: AWS, GCP and other connected integrations

Its goal is to identify malicious patterns that would not have triggered standard detection rules — filling blind spots in static analytical rules.

Examples of Identified Detections

• Unusual internal phishing campaigns
• Suspicious e-discovery searches
• Suspicious OAuth application modifications
• Authentications via anonymous proxies (Tor network, questionable VPNs)
• Sensitive data access by compromised accounts

Access to Alerts in Defender Portal

Incidents detected by this agent are accessible via:

1security.microsoft.com > Investigations > Incidents & Alerts > Incidents
2Quick filter: "Incidents involving AI detections"

Each generated alert includes:

• Description of the detected anomaly
• MITRE ATT&CK mapping (associated tactics and techniques)
• Evidence and indicators motivating the detection
• Recommended actions

Public Demonstration and Official Resources

Microsoft provides a public demonstration of the Phishing Triage Agent accessible without authentication:

• Phishing Triage Agent Demo: aka.ms/ptademo
• Security Copilot Documentation: learn.microsoft.com/security-copilot
• Security Copilot Platform: securitycopilot.microsoft.com
• Defender Portal: security.microsoft.com
• Security Copilot Pricing (SCU): Azure Pricing - Copilot for Security

Building Your Own Security Copilot Agent

If native agents don't cover a use case specific to your organization, the Security Copilot platform allows developing custom agents. Two approaches are available:

Summary: Evolution Toward Agentic AI in SOCs

The four Security Copilot agents in Microsoft Defender represent a major architectural evolution for modern SOCs, structured around four operational pillars:

• Anticipate and prevent: Threat Intel Briefing Agent (personalized reports, active CVEs, EASM)
• Detect and disrupt: Dynamic Threat Detection Agent (continuous 24/7 detection, blind spots)
• Triage and investigate: Phishing Triage Agent + Threat Hunting Agent (MTTT < 4 min, assisted KQL)
• Document and optimize: Analyst Notes + Custom Guidebooks (structured handoff, integrated SOPs)