book

Microsoft Security Copilot

Name: Microsoft Security Copilot
ISBN: 9781835884522

by Bi Yue Xu, Rod Trent

July 2025

Intermediate to advanced

576 pages

12h 53m

English

Packt Publishing

Read now

Unlock full access

Preface
Who this book is forWhat this book coversTo get the most out of this bookGet in touchStay relevant in a rapidly changing cybersecurity world – join 65,000+ SecPro subscribers
Elevating Cyber Defense with Security Copilot
Getting the most out of this book – get to know your free benefitsNext-gen readerInteractive AI assistant (beta)DRM-free PDF or ePub version AI evolution – core principles and generative advancesThe emergence of machine learningThe rise of deep learning and neural networksIntroducing generative AILLMsUnderstanding natural language processingPutting it all togetherIntroducing Microsoft Security CopilotMicrosoft 365 CopilotDynamics 365 CopilotCopilot in Power PlatformGitHub CopilotDiscovering Microsoft Security CopilotSummaryFurther reading
Unveiling Security Copilot through Its Embedded Experience
Security Copilot – your ultimate security assistantLeveraging Security Copilot in Microsoft Defender XDRIncident summaryGuided responsesScripts, command lines, and registry keys analysisFile analysisDevice summaryAdvanced hunting using KQLIncident reportsIntegrating Security Copilot with Microsoft EntraExploring Security Copilot within Microsoft PurviewData loss prevention alert investigationeDiscoveryInsider risk managementCommunication complianceEnhancing security with Microsoft Defender for CloudUtilizing Security Copilot in Microsoft IntunePolicy and settings managementDevice details and troubleshootingFrom the embedded experience to the standalone experiencePluginCapability/skillPromptPromptbookSessionSummary
Navigating the Security Copilot Platform
Setting the stage – technical requirements and onboardingGetting ready for onboardingOnboarding Security CopilotStep 1 – provision capacityStep 2 – setting up the default environment for Security CopilotNavigating the user interfacesThe embedded experience – key aspects explainedThe standalone experienceCase study – harnessing Security Copilot in defending against cyber threatsInitial access, discovery, and defense evasionCredential accessLateral movementPersistenceCredential accessSummarySubscribe to _secpro – the newsletter read by 65,000+ cybersecurity professionals
Extending Security Copilot’s Capabilities with Plugins
Exploring Security Copilot pluginsCapabilities (or skills) of each pluginUnleashing the power of preinstalled Microsoft pluginsSecurity Copilot Defender XDR pluginsSecurity Copilot for External Attack Surface Management pluginSecurity Copilot Threat Intelligence pluginSecurity Copilot Purview pluginSecurity Copilot Entra pluginOther pluginsOpenAI and beyond – Delving into non-Microsoft pluginsBuilt-in plugins in Security CopilotNon-Microsoft pluginsCrafting your own – The world of custom pluginsSummary
The Art of Prompt Engineering
The science of prompt creationUnlocking Security Copilot for smart promptingThe power of natural language in promptsContext awareness and session awarenessCrafting effective security promptsBe clear and specific Use iteration to refine promptsLeverage context to narrow down focusUse positive instructions to boost efficiencyMore tips for crafting effective promptsOpenness encourages creativityPrompt engineering best practices and error handlingHarnessing Security Copilot’s knowledge and capabilitiesChoose your preferred pluginCustom plugin powered by KQLUsing a KQL template for Security CopilotAI in action – expect variability in your resultsCommon error handlingSummary
The Power of Promptbooks in Security Copilot
Demystifying promptbooks – an introductionThe prebuilt promptbook arsenalMicrosoft promptbook – Microsoft 365 Defender incident investigationMicrosoft promptbook – Suspicious script analysisMicrosoft promptbook – Threat actor profileMicrosoft GitHub promptbooks Tailoring custom promptbooks for security needsDesigning and creating your own promptbookTurning a session into a promptbookDouble the fun – duplicating a promptbookPolishing your promptbookThe joy of sharingPromptbooks in action – sample promptbooks and tipsThe promptbook playgroundExtra hacks and tips for your promptbooksSummary
Automation and Integration – The Next Frontier
Integrating Security Copilot with Logic AppsAzure Logic Apps – the brains behind automationThe Security Copilot Logic Apps connectorPowering up automation with Logic Apps and Security CopilotEmpowering Security Copilot with custom knowledge base integrationUsing the file upload option to boost Security Copilot’s knowledge baseImporting files into Security Copilot in a snapReferencing the uploaded file in a promptSupercharging Security Copilot with the Azure AI Search pluginSetup guide for the Azure AI Search plugin Referencing Azure AI Search in a promptSummarySubscribe to _secpro – the newsletter read by 65,000+ cybersecurity professionals
Cyber Sleuthing with Security Copilot
Advancing XDR investigations with Security CopilotThe Security Copilot incident summaryCracking the case – uncovering suspicious remote sessions with Security CopilotUncovering malicious processes with Security Copilot promptbooksFollowing the file trail with Security Copilot Unmasking PowerShell activities with Security CopilotStreamlining incident response with promptbooksSummary
Harnessing Security Copilot within the Microsoft Ecosystem
Identifying and investigating user threats with Entra and Security CopilotHarnessing Security Copilot for user account investigationsUncovering authentication and account changes with Security CopilotTurning investigation insights into action with Security CopilotShowcasing Intune capabilities enhanced by Security Copilot for IT admins and SOC analystsUnlock device insights with Security Copilot Accelerating device comparisons with Security CopilotSay goodbye to Intune policy conflicts with Security CopilotSummary

Frontline Tales with Security Copilot
Enhancing security incident investigations with MDTI and Security CopilotHarnessing Security Copilot to uncover cyber risks and drive proactive defenseExtracting IOCs from the open webOptimizing and streamlining threat validationTracking and uncovering threat actor infrastructuresUncovering hidden connections with host pair relationshipsEmpowering CISOs with proactive defense and actionable insightsEmpowering CISOs to tackle emerging threats with proactive defense strategiesInsights into emerging ransomware threatsEnabling CISOs with actionable incident insightsSummary
The Pricing Model in Security Copilot
The role of the SCUUnderstanding the Security Copilot pricing modelUnderstanding base costUnderstanding overage chargesA guide for practitioners in monitoring and managing SCUsThe SCU Usage monitoring dashboardThe Security Copilot audit logAdvanced Hunting in Microsoft Defender XDRLeveraging custom plugins and Sentinel workbooksMaximizing value and efficiency in SCU usageDirect skill invocation is more efficient in SCU consumptionNot all prompts need to be handled by Security CopilotLogic apps to streamline prompts and responsesWell-tuned promptbooks use fewer SCUs and deliver better resultsScheduling non-urgent tasks during off-peak hoursStreamlining SCU allocation through scheduled automationAdjusting workflows and promptbooks as AI models changeSummaryStay connected and keep learningLooking aheadSubscribe to _secpro – the newsletter read by 65,000+ cybersecurity professionals
Unlock Your Book’s Exclusive Benefits
How to unlock these benefits in three easy stepsStep 1Step 3Need help?
Appendix A – Security Copilot Agents
Microsoft-developed agentsThreat Intelligence Briefing AgentPhishing Triage Agent in Microsoft DefenderMicrosoft Entra CA optimization agentVulnerability Remediation Agent in Microsoft IntuneData loss prevention triage agentInsider Risk Management triage agentPartner agentsUnderstanding agent pricing and SCU consumptionSummary
Appendix B – Additional Resources
Power up your skills with training resourcesExplore and collaborate through GitHub repositories Bootcamps and technical training skill building The path to expertise – The certification journey
Index
Other Books You May Enjoy
Stay relevant in a rapidly changing cybersecurity world – join 65,000+ SecPro subscribers

Overview

Immerse yourself in the cutting-edge world of AI-powered cybersecurity with "Microsoft Security Copilot." This book delves into the core features of Microsoft Security Copilot, from handling real-world cybersecurity challenges to mastering advanced automation tools and AI analytics. By the end, you'll be equipped to address complex cyber threats and strengthen your organization's security framework using state-of-the-art tools.

What this Book will help me do

You will learn to effectively utilize Microsoft Security Copilot for advanced cybersecurity defense strategies.
You will understand and employ the principles of prompt engineering and design impactful prompts for efficient workflows.
You will develop, optimize, and manage custom promptbooks tailored to organizational needs.
You will gain insights into creating and integrating plugins to extend the capabilities of Security Copilot.
You will explore practical use cases and apply advanced AI techniques for threat detection and response.

Author(s)

Bi Yue Xu and Rod Trent are experienced professionals in the field of cybersecurity and AI-enabled solutions. Bi Yue Xu has a background in developing enhanced security systems utilizing cutting-edge technologies, while Rod Trent brings extensive experience in cybersecurity automation and process optimization. Together, they provide a balanced and insightful approach to leveraging Microsoft tools for cybersecurity.

Who is it for?

This book is aimed at cybersecurity professionals and IT specialists who are looking to evolve their familiarity with AI-powered cybersecurity tools. It is applicable whether you're a beginner seeking to master Microsoft Security Copilot or an advanced security professional hoping to refine your skills. With actionable insights and practical examples, this book targets anyone wanting to leverage AI for robust cybersecurity.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781835884522

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills