Build a SOC Triage Agent with Microsoft Security Copilot, Sentinel and Defender XDR

Why security teams start with triage

Alert fatigue is the most common SOC pain point. A triage agent that summarises incidents, enriches indicators and recommends next steps gives analysts back hours every day — without letting AI take destructive action on its own.

Business scenario

A 5-person SOC receives 300 alerts per day from Microsoft Defender XDR and Microsoft Sentinel. Most are phishing reports and sign-in anomalies. The goal:

• Every new high or medium incident gets an AI summary within minutes.
• Phishing reports are classified automatically.
• Analysts approve containment actions with one click.

Components

• Microsoft Security Copilot (provisioned with Security Compute Units, SCUs).
• Microsoft Defender XDR and Microsoft Sentinel as data sources.
• Built-in agents, such as the Phishing Triage Agent in Defender.
• Custom plugins and promptbooks for your own processes.
• Azure Logic Apps for automation.

Step 1 — Provision Security Copilot

1. Create Security Copilot capacity and choose the number of SCUs (start small and monitor usage).
2. In securitycopilot.microsoft.com, complete setup and choose where data is stored.
3. Assign roles: Copilot owners for administrators, Copilot contributors for analysts. Security Copilot respects each user's existing Defender and Sentinel permissions.

Step 2 — Enable plugins

Turn on the Microsoft plugins you have licences for: Defender XDR, Sentinel, Entra, Intune, Purview, and Defender Threat Intelligence. Each plugin lets the agent query that product with the user's permissions.

Step 3 — Start with a built-in agent

Before building custom logic, enable the Phishing Triage Agent in the Defender portal:

1. Go to the Security Copilot agents area and set up the agent.
2. Give it an identity and permissions limited to the phishing queue.
3. Review its verdicts (true phishing vs. false positive) and give feedback in plain language — the agent learns your organization's patterns.

Step 4 — Create a custom promptbook

Promptbooks turn your runbook into repeatable steps. Example "Suspicious sign-in triage":

1. Summarize incident <incident id> from Defender XDR, including impacted users and devices.
2. For each user, show risky sign-ins and MFA status from Entra ID in the last 7 days.
3. Run this KQL in Sentinel and summarize the result:
   SigninLogs
   | where UserPrincipalName == "<user>"
   | where TimeGenerated > ago(7d)
   | summarize count() by IPAddress, Location, AppDisplayName
4. Check reputation of all external IPs with Defender Threat Intelligence.
5. Recommend a verdict (true positive / benign / false positive) with reasons.
6. Draft containment steps, but do not execute them.

Save it, share it with the SOC, and add input parameters for the incident ID and user.

Step 5 — Build a custom plugin for internal data

Your CMDB or HR system knows who owns an asset and whether a user is a VIP. Expose that through an API (for example an Azure Function) and describe it in an OpenAPI plugin manifest:

Descriptor:
  Name: ContosoAssetLookup
  DisplayName: Contoso Asset Owner Lookup
  Description: Returns owner, business unit and criticality for a device name.
SkillGroups:
  - Format: API
    Settings:
      OpenApiSpecUrl: https://contoso-func.azurewebsites.net/openapi.yaml

Upload it under Sources, Custom. Now prompts like "Who owns device FIN-LAP-022 and how critical is it?" work inside triage.

Step 6 — Automate with Logic Apps

1. Create a Sentinel automation rule for new medium and high incidents.
2. Trigger a Logic App that calls the Security Copilot connector with your promptbook.
3. Write the summary back as a comment on the incident.

Analysts now open each incident with a summary already waiting.

Step 7 — Keep humans in control

• Containment (isolate device, disable account, revoke sessions) stays a manual approval in Defender or a Teams adaptive card.
• Log all agent actions; review weekly.
• Measure: mean time to triage, percentage of incidents with AI summary, analyst feedback.

Cost management

Security Copilot is billed by SCU. Track usage in the usage dashboard, run promptbooks on high and medium incidents only, and adjust capacity after the first month.

Learn more

• Microsoft Learn: What is Microsoft Security Copilot — https://learn.microsoft.com/copilot/security/microsoft-security-copilot
• Microsoft Learn: Promptbooks — https://learn.microsoft.com/copilot/security/using-promptbooks