| title | Summarize incidents with Microsoft Copilot in Microsoft Defender | ||||
|---|---|---|---|---|---|
| description | Generate incident summaries with Microsoft Copilot embedded in Microsoft Defender. | ||||
| ms.service | defender-xdr | ||||
| f1.keywords |
|
||||
| ms.author | guywild | ||||
| author | guywi-ms | ||||
| ms.localizationpriority | medium | ||||
| manager | deniseb | ||||
| audience | ITPro | ||||
| ms.collection |
|
||||
| ms.topic | how-to | ||||
| search.appverid |
|
||||
| ms.date | 11/18/2024 | ||||
| ms.update-cycle | 180-days | ||||
| appliesto |
|
[!INCLUDE Microsoft Defender XDR rebranding]
Microsoft Defender XDR applies the capabilities of Security Copilot to summarize incidents, delivering impactful information and insights to simplify investigation tasks. Attack investigation is a crucial step for incident response teams to successfully defend an organization against further damage from a cyber threat. Investigations can often be time-consuming as they involve numerous steps. Incident response teams need to understand how the attack happened: sort through numerous alerts, identify which assets and entities are involved, and assess the scope and impact of an attack.
This guide outlines what to expect and how to access the summarizing capability of Copilot in Defender, including information on providing feedback.
If you're new to Security Copilot, you should familiarize yourself with it by reading the following articles:
- What is Security Copilot?
- Security Copilot experiences
- Get started with Security Copilot
- Understand authentication in Security Copilot
- Prompting in Security Copilot
Incident responders can easily gain the right context to investigate and remediate incidents through Defender XDR's correlation capabilities and Security Copilot's AI-powered data processing and contextualization. With an incident summary, responders can quickly get important information to help in their investigation.
The incident summary capability is available in the Microsoft Defender portal for customers who have provisioned access to Security Copilot.
This capability is also available in the Security Copilot standalone experience through the Microsoft Defender XDR plugin. Know more about preinstalled plugins in Security Copilot.
Incidents containing up to 100 alerts can be summarized into one incident summary. An incident summary, depending on the availability of the data, includes the following:
- The time and date when an attack started.
- The entity or asset where the attack started.
- A summary of timelines of how the attack unfolded.
- The assets involved in the attack.
- Indicators of compromise (IoCs).
- Names of threat actors involved.
- Suggested Security Copilot prompts, which guide you to focus on the most relevant next steps, gain deeper insights, and simplify investigations.
To summarize an incident:
-
Open an incident page. Copilot automatically creates an incident summary upon opening the page. You can stop the summary creation by selecting Cancel or restart creation by selecting Regenerate.
-
The incident summary card loads on the Copilot pane. Review the generated summary on the card. Review the summary and use the information to guide your investigation and response to the incident.
:::image type="content" source="media/copilot-in-defender/incident-summary/copilot-defender-incident-summary.png" alt-text="Screenshot that shows the incident summary card on the Copilot pane as seen in the Microsoft Defender incident page." lightbox="media/copilot-in-defender/incident-summary/copilot-defender-incident-summary.png":::
[!TIP] You can navigate to a file, IP, or URL page from the Copilot results pane by clicking on the evidence in the results.
-
Select See prompts to view suggested prompts. Suggested prompts surface relevant follow-up questions based on the most crucial information in the given incident.
Select a suggested prompt to get more insights about the specific assets involved in the incident, such as device summaries, identity summaries, and related threat intelligence.
:::image type="content" source="media/security-copilot-m365d-incident-summary/copilot-defender-incident-summary-see-prompts.png" lightbox="media/security-copilot-m365d-incident-summary/copilot-defender-incident-summary-see-prompts-large.png" alt-text="Screenshot that shows the Copilot suggested prompts on the incident summary card.":::
-
Select the More actions ellipsis (...) at the top of the incident summary card to copy or regenerate the summary, or view the summary in the Security Copilot portal. Selecting Open in Security Copilot opens a new tab to the Security Copilot standalone portal where you can input prompts and access other plugins.
:::image type="content" source="media/security-copilot-m365d-incident-summary/incident-summary-options.png" alt-text="Screenshot that shows the actions available on the incident summary card.":::
By default, Copilot generates a summary for each incident the user opens, but you can change this setting to display incident summaries only in specific instances. You can choose to have summaries generated:
- Always (for every incident opened)
- Based on the severity level of the incident
- On demand only
To change the settings for Copilot incident summaries in Microsoft Sentinel, follow these steps:
-
Go to System > Settings > Copilot in Defender in the Microsoft Sentinel navigation pane.
:::image type="content" source="media/security-copilot-m365d-incident-summary/copilot-settings.png" alt-text="Screenshot that shows the Copilot settings page in Microsoft Sentinel.":::
-
Under Preferences, select Incident Summary generation.
-
Select either Auto-generate or Generate on demand, depending on your preference.
-
If you select Auto-generate, choose between Always or Incident severity. If you select Incident severity, choose the minimum severity level for which you want Copilot to generate incident summaries automatically.
:::image type="content" source="media/security-copilot-m365d-incident-summary/copilot-settings-preferences.png" alt-text="Screenshot that shows the Copilot settings preferences page in Microsoft Sentinel.":::
-
Select Save.
-
When you select Incident severity, an estimate of the number of incidents of each severity level reviewed per day is displayed, along with the estimated SCU consumption.
:::image type="content" source="./media/security-copilot-m365d-incident-summary/incident-severity.png" alt-text="Screenshot that shows the approximate number of incidents of each severity level.":::
-
Copilot saves generated incident summaries for a week. If you select an incident whose summary is in the cache, and the incident hasn't changed significantly, the summary is automatically redisplayed at no cost regardless of the setting.
-
To generate a summary on demand for an incident that's not automatically generated, select the Generate button.
:::image type="content" source="media/security-copilot-m365d-incident-summary/generate-summary.png" alt-text="Screenshot that shows the Generate summary button on the incident page.":::
In the Security Copilot standalone portal, you can use the following prompt to generate incident summaries:
- Provide a summary for Defender incident {incident ID}.
Tip
When generating an incident summary in the Security Copilot portal, Microsoft recommends including the word Defender in your prompts to ensure that the incident summary capability delivers the results.
Microsoft highly encourages you to provide feedback to Copilot, as it's crucial for a capability's continuous improvement. You can provide feedback on the summary by selecting the feedback icon 
found on the bottom of the Copilot pane.
- Learn about other Security Copilot embedded experiences
- Privacy and data security in Security Copilot
[!INCLUDE Microsoft Defender XDR rebranding]