Microsoft Promises SOC Relief with Coming Security Copilot AI -- Redmondmag.com

Microsoft Promises SOC Relief with Coming Security Copilot AI

Microsoft Security Copilot is currently at the invite-only early preview stage.

By Kurt Mackie
10/19/2023

The coming Security Copilot artificial intelligence implementation in Microsoft 365 Defender will ease routine tasks for Security Operations Center (SOC) personnel, Microsoft suggested, in a Thursday announcement.

SOC personnel won't have to perform investigations or compile incident reports. The Security Copilot integration in Microsoft 365 Defender will translate what the attack code does, too, the announcement indicated.

Currently, Security Copilot is at the "early access" invitation-only stage now, having been unveiled back in March. Security Copilot uses OpenAI's models, as well as "Microsoft’s security-specific model trained on the largest breadth and diversity of security signals in the industry -- over 65 trillion to be precise," the announcement explained.

Microsoft is adding Security Copilot to its Microsoft 365 Defender extended detection and response (XDR) platform, and that integration will offer "an intuitive experience" for SOC analysts, Microsoft indicated. Specifically, Security Copilot will show summaries of incidents that analysts can investigate. However, Microsoft suggested that the summary report would be good enough, as is:

By leveraging the incident summary, SOC analysts no longer need to perform an investigation to determine what is most urgent in their environment, making prioritization, understanding impact and required next steps, easy and reducing time to respond.

If wanted, though, analysts can craft a report of an incident by simply clicking a "Generate incident report button."

The hunting capability in Microsoft 365 Defender also works with Security Copilot. Users can ask Security Copilot to produce a hunting query, which gets generated in the form of the Kusto Query Language. It's also possible for analysts to use Security Copilot to analyze a PowerShell script used in an attack and "turn it into human-readable language," Microsoft indicated.

Analysts using Microsoft 365 Defender with Security Copilot will get "guided response recommendations" as well. These responses are based on "past actions taken by the organization in response to similar alerts or incidents," Microsoft explained.

It's not clear when this Security Copilot integration will be available for testing. Microsoft's announcement included a sign-up link, but it's not a download link or trial sign-up form. People signing up will just get information on Microsoft's security product announcements.

According to the Security Copilot landing page FAQ, interested organizations wanting to get involved in the Early Access Program should "contact your account representative" to see if they are eligible.

Microsoft's announcement included a list of Microsoft Learn documents at the end. Possibly, people can access them, but my attempt was blocked.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Multi-Tenant Organization Hooks Released for Microsoft 365

Microsoft Entra ID's new multi-tenant organization capabilities have reached general availability (GA).
Real-World Ransomware Recovery

Here's how I was (mostly) successful in recovering a family PC infected with malware.
Microsoft Launches Small AI Models Family Phi-3

Recognizing that bigger isn't always better, Microsoft has released its smallest open AI models to date, Phi-3.
Microsoft and OpenAI Continue Global AI Expansions

Microsoft and OpenAI each continued their global expansion this month, with the announcements of new infrastructure investments and service rollouts in new regions, like Asia and the Middle East.
Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.