Microsoft Security Copilot

Navigate the growing complexity of cyber security by examining people, cloud, endpoints, and networks, and highlight talent gaps, advanced threats, automation shortfalls, data overload, and awareness training and phishing campaigns.

Explore how a security operations center uses threat intelligence, threat hunting, log management, and threat detection to identify adversary behavior, gather IOCs, and reduce the attack surface.

Explore the NIST incident handling process, including preparation, detection and analysis, containment, eradication and recovery, and post-incident activity to reduce impact and apply lessons learned.

Clarify the differences between intelligence, threat intelligence, and cyber threat intelligence, showing how CTI links adversaries' TTPs to cyber security while general threat intelligence can apply beyond cyber domains.

Clarify threats, vulnerabilities, and risks by defining threat actors and how exploitation of vulnerabilities causes downtime, confidentiality breaches, or integrity violations. Define risk as the combination of impact and likelihood.

Explain threat informed defense by defining your mission, identifying threat actors and motivations, mapping their TTPs, and focusing detection against those risks.

Explore the hierarchy of tactics, techniques, and procedures (ttps) in cyber threat intelligence, clarifying high-level attacker objectives, how techniques realize those tactics, and the sequences of actions that form procedures.

Examine three CTI sources: enterprise tools like Defender Threat Intelligence and CrowdStrike; open-source intelligence such as VirusTotal and Shodan; and social media platforms for IOCs, IOAs, and TTPs insights.

Define vulnerabilities as weaknesses in information systems, including software, humans, hardware, and physical controls; emphasize that many vulnerabilities lack CVEs, and misconfigurations can be exploited.

Learn how CVSS scores rank vulnerabilities to prioritize remediation, compare version 2 and version 3, and consider asset criticality and the none and critical severities, using a calculator.

Explore the azure global backbone, its data centers and connectivity across 60 regions, 130 miles of fiber, subsea cables, edge sites, and 20,000 peering connections for performance and disaster recovery.

Explore shared responsibility across on-premises, IaaS, PaaS, and SaaS in Azure, AWS, and GCP, highlighting what customers and Microsoft own—from physical layers to identities and data.

Explore Azure subscription types, including free, student, pay as you go, and enterprise agreement, with notes on free credits for 30 days and 12 months and demos.

Explore how Entra ID tenants serve as identity providers and control access to Azure subscriptions and resource groups, clarifying that subscriptions are not tenants.

Treat zero trust as a security strategy and mindset, not a product. Enforce three principles: verify explicitly, apply just-in-time least privilege, and assume breach to minimize blast radius.

Navigate the Microsoft security cosmos, focusing on cloud security, SOC, and CTI, powered by Defender XDR suites for identity, endpoint, cloud apps, all 365, cloud, and Microsoft Sentinel with Copilot.

Defend the attack chain with Defender for Office, Defender for Endpoint, Defender for Identity, Entra ID protection, Cloud Apps, XDR, Sentinel, and Copilot for security against phishing and data exfiltration.

Define prompts as user inputs that guide large language models to produce outputs. Craft prompts with clear context and flexible formats to improve accuracy, including threat intelligence and structured commands.

Explore the worldwide application security project, its top ten risks for web apps, APIs, and large language models, and its tools like OWASP ZAP and Web Security Testing Guide.

Discover how adversaries leverage AI to spread misinformation, create fake images and news, and conduct personalized phishing at scale. AI-driven tools democratize cybercrime and enable impersonation and exploit research.

Explore how Microsoft defines AI in a responsible fashion, focusing on fairness, reliability, safety, privacy, security, inclusiveness, transparency, and accountability.

Explore the shared responsibility model for AI in the Microsoft cloud, detailing how responsibilities split across AI usage, application, and platform, varying by IaaS, PaaS, and SaaS offerings.

Microsoft Copilot for security uses generative ai to assist defenders in incident response, threat hunting, intelligence gathering, and posture management with incident summarization and guided responses.

Explore how prompts drive Copilot for security, where a user submission triggers context, planning with plugins, execution, and a final response, with guidance on good versus bad prompts.

Explore the copilot for security architecture: three pillars—security data, threat intelligence, and copilot prompts. Learn how embedded and standalone experiences, plugins, and Azure OpenAI enable processing and responsible AI checks.

Extend Copilot for security with Microsoft plugins and select third-party options, including Defender XDR and Sentinel. Build custom plugins via API or KQL and connect through Azure Logic Apps.

Explore the standalone and embedded experiences of security copilot, comparing web access via security copilot Microsoft.com with native embeddings in defender xdr, entra, intune, and purview.

Explore pricing for Microsoft Security Copilot by provisioning security compute units (ECU) per hour at $4, start with three SKUs per hour, and expect an estimated monthly bill around $2,900.

Identify the three onboarding requirements for Copilot for security: an Azure subscription, an Entra ID tenant with roles and users, and provisioning security capacity units (CEUs).

Launch copilot for security in the standalone experience, select the created capacity, and explore the dashboard, prompt window, and prompt books to automate investigations.

Define your objective, provide context, specify plugins and the audience length and detail, and state information sources to guide Copilot; iterate prompts to improve responses.

Monitor your consumption using usage monitoring, view provisioned SKUs per hour and what was leveraged and consumed, and filter by time ranges for transparent prompt usage.