|
| 1 | +--- |
| 2 | +title: Summarize identity information with Microsoft Copilot in Microsoft Defender |
| 3 | +description: Summarize an identity information with Microsoft Copilot in Microsoft Defender to investigate identities. |
| 4 | +ms.service: defender-xdr |
| 5 | +f1.keywords: |
| 6 | + - NOCSH |
| 7 | +ms.author: diannegali |
| 8 | +author: diannegali |
| 9 | +ms.localizationpriority: medium |
| 10 | +manager: deniseb |
| 11 | +audience: ITPro |
| 12 | +ms.collection: |
| 13 | + - m365-security |
| 14 | + - tier1 |
| 15 | + - security-copilot |
| 16 | +ms.topic: conceptual |
| 17 | +search.appverid: |
| 18 | + - MOE150 |
| 19 | + - MET150 |
| 20 | +ms.date: 09/23/2024 |
| 21 | +appliiesto: |
| 22 | +- Microsoft Defender XDR |
| 23 | +- Microsoft Sentinel in the unified security operations center (SOC) platform |
| 24 | +--- |
| 25 | + |
| 26 | +# Summarize identity information with Microsoft Copilot in Microsoft Defender |
| 27 | + |
| 28 | +[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)] |
| 29 | + |
| 30 | +Security operations teams investigating users can easily understand identity information with the identity summary capability in [Microsoft Copilot for Security](/security-copilot/microsoft-security-copilot) in Microsoft Defender. Through generative AI and harnessing the power of Microsoft Defender for Identity, Copilot creates contextual insights about an identity in an organization, helping analysts quickly understand important data to speed up their investigation. |
| 31 | + |
| 32 | +With the identity summary capability, analysts can immediately identify suspicious or risky identity-related changes and actions that can negatively impact an organization. The summary also includes potential misconfigurations that affects an identity. Using natural language, Copilot delivers clear and actionable user information that analysts can use in their incident investigation activities. The capability currently focuses on users and will include service accounts in its next iteration. |
| 33 | + |
| 34 | +The identity summary contains essential information about an identity, including: |
| 35 | + |
| 36 | +- The date when a user account is created, and whether the user account is of high, medium, or low criticality |
| 37 | +- Any unusual behavioral patterns related to sign in locations, sign in frequency, or frequency of failed sign in attempts |
| 38 | +- A user’s current role, including their department and position, and whether there are notable role changes compared to the user’s job title and department to highlight inconsistencies |
| 39 | +- Data about a user’s last sign in to a device, whether or not the device is associated to the user, in the last 30 days |
| 40 | +- Authentication methods and applications used |
| 41 | +- Risks associated with a user based on Microsoft Entra ID |
| 42 | +- General information like a user’s professional title and contact information, department, and their manager’s contact information |
| 43 | + |
| 44 | +The identity summary capability is available in the Microsoft Defender portal for customers who have provisioned access to Copilot for Security. Users who access the Copilot for Security standalone portal can use this capability through the Microsoft Defender XDR plugin. Know more about [preinstalled plugins in Copilot for Security](/security-copilot/manage-plugins#preinstalled-plugins). |
| 45 | + |
| 46 | +This guide describes what the script analysis capability is and how it works, including how you can provide feedback on the results generated. |
| 47 | + |
| 48 | +## Summarize identity information |
| 49 | + |
| 50 | +You can access the identity summary capability in the following ways: |
| 51 | + |
| 52 | +- From an incident page, choose an identity on the incident graph and then (1) select **User details**. In the user details pane, (2) select **Summarize**. The results are displayed in the Copilot side panel. |
| 53 | + |
| 54 | + :::image type="content" source="/defender/media/copilot-in-defender/identity-summary/identity-incident-graph-small.png" alt-text="Screenshot showing the Summarize option in the user details pane." lightbox="/defender/media/copilot-in-defender/identity-summary/identity-incident-graph.png"::: |
| 55 | + |
| 56 | +- Alternatively, you can select **Go to user page** on the bottom of the user details pane to open the user page. Copilot automatically generates the identity summary and displays the side panel upon opening the user page. |
| 57 | + |
| 58 | +- You can also access the identity summary capability by choosing a user in the **Assets** tab of an incident. Select **Summarize** in the user details pane to generate the identity summary. |
| 59 | + |
| 60 | + :::image type="content" source="/defender/media/copilot-in-defender/identity-summary/identity-assets-small.png" alt-text="Screenshot showing the Assets tab and a user account highlighted." lightbox="/defender/media/copilot-in-defender/identity-summary/identity-assets.png"::: |
| 61 | + |
| 62 | +- From the main menu, navigate to **Assets > Identities**. Select a username from the list, then select **View user page** to open the user page. Copilot automatically generates the identity summary and displays the side panel upon opening the user page. |
| 63 | + |
| 64 | + :::image type="content" source="/defender/media/copilot-in-defender/identity-summary/identity-identities-small.png" alt-text="Screenshot highlighting the view user page option in an username search within Identities." lightbox="/defender/media/copilot-in-defender/identity-summary/identity-identities.png"::: |
| 65 | + |
| 66 | +- Type a username in the Microsoft Defender portal’s **search box** then select the username from the search results. In the user details side panel, select **Summarize** to generate the identity summary. |
| 67 | + |
| 68 | +Review the identity summary results. You can copy the results to clipboard, regenerate the results, or open Security Copilot by selecting the More actions ellipsis (...) on top of the identity summary card. You can extend your investigation of identity using prompts and other plugins in the Copilot for Security portal. |
| 69 | + |
| 70 | +> [!TIP] |
| 71 | +> When investigating users in the Copilot for Security portal, Microsoft recommends including the word ***Defender*** in your prompts to ensure that the identity summary capability delivers the results. For example, you can use the prompt *Show the Defender summary of this user in the last {time frame}* to generate the identity summary of a user account within the time frame indicated. You can specify up to 120 days on the time frame, with the default being 30 days when you don’t indicate one. |
| 72 | +
|
| 73 | +Microsoft highly encourages you to provide feedback to Copilot, as it’s crucial for a capability’s continuous improvement. To provide feedback, navigate to the bottom of the Copilot side panel and select the feedback icon . |
| 74 | + |
| 75 | + :::image type="content" source="/defender/media/copilot-in-defender/identity-summary/feedback-textbox.png" alt-text="Screenshot that shows the Feedback text box where you can share your feedback."::: |
| 76 | + |
| 77 | +Fill in the dedicated text box to share your thoughts, experiences, and requests. Microsoft values your feedback and takes it seriously in our commitment to enhance Copilot’s performance and user experience. |
| 78 | + |
| 79 | +## See also |
| 80 | + |
| 81 | +- [Get started with Microsoft Copilot for Security](/security-copilot/get-started-security-copilot) |
| 82 | +- [Learn about other Copilot for Security embedded experiences](/security-copilot/experiences-security-copilot) |
| 83 | + |
| 84 | +[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)] |
0 commit comments