Skip to content

Commit b07134f

Browse files
diannegalidiannegali
committed
updated text
1 parent 2f9eecf commit b07134f

File tree

2 files changed

+81
-56
lines changed

2 files changed

+81
-56
lines changed

‎defender-xdr/phishing-triage-agent.md‎

Lines changed: 78 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: Phishing Triage Agent in Microsoft Defender
3-
description: Learn about the Phishing Triage Agent, including requirements for setup and providing feedback to the agent.
2+
title: Security Copilot Phishing Triage Agent in Microsoft Defender
3+
description: Learn about the Security Copilot Phishing Triage Agent, including requirements for setup and providing feedback to the agent.
44
ms.service: defender-xdr
55
f1.keywords:
66
- NOCSH
@@ -14,7 +14,7 @@ ms.collection:
1414
- tier1
1515
- security-copilot
1616
- magic-ai-copilot
17-
ms.topic: concept-article
17+
ms.topic: how-to
1818
search.appverid:
1919
- MOE150
2020
- MET150
@@ -25,7 +25,7 @@ appliesto:
2525
#customer intent: As a security analyst, I want to learn about the Phishing Triage Agent in Microsoft Defender so that I can triage and classify user-submitted phishing incidents efficiently.
2626
---
2727

28-
# Phishing Triage Agent in Microsoft Defender
28+
# Microsoft Security Copilot Phishing Triage Agent in Microsoft Defender
2929

3030
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
3131

@@ -54,14 +54,34 @@ The following are organizational requirements to run Phishing Triage Agent in yo
5454

5555
|Components|Details|
5656
|:---|:---|
57-
|Licenses|- A tenant must have provisioned access to Security Copilot. See [Get started with Security Copilot](/copilot/security/get-started-security-copilot) for more information </br> - A tenant must have any of the following licenses deployed: - Microsoft Defender for Office Plan 2 </br> - Microsoft 365 E5|
58-
|Accessing the agent|- A tenant must have access to the Microsoft Defender portal </br> - Unified role-based access control (URBAC) must be enabled in your organization. See [Unified role-based access control (URBAC)](manage-rbac.md) for more information|
59-
|Roles required|- **Security Administrator** role is required to set up and manage the Phishing Triage Agent </br> - Users with the same permissions as the agent can view the agent's output|
60-
|Alert policy|The alert policy **Email reported by user as malware or phish** must be turned on. See [Alert policies in the Microsoft Defender portal](alert-policies.md) for more information|
57+
|Products|- An active subscription to Security Copilot and provision capacity in Security Compute Units (SCU) to power Security Copilot workload. See [Get started with Security Copilot](/copilot/security/get-started-security-copilot) for more information </br> - Microsoft Defender for Office Plan 2 deployed|
58+
|Microsoft Defender required features|- Unified role-based access control (URBAC) must be enabled in your organization. See [Unified role-based access control (URBAC)](manage-rbac.md) for more information </br> - *Monitor reported messages in Outlook* must be turned on </br> - The alert policy **Email reported by user as malware or phish** must be turned on. See [Alert policies in the Microsoft Defender portal](alert-policies.md) for more information|
59+
|Security Copilot plugins required|The following plugins must be enabled in Security Copilot: </br> - Microsoft Defender XDR </br> - Microsoft Threat Intelligence </br> - Phishing Triage Agent|
6160

62-
The following requirements are needed when setting up the Phishing Triage Agent:
61+
## Set up the Phishing Triage Agent
6362

64-
### Permissions
63+
> [!NOTE]
64+
> Setup and management of the Phishing Triage Agent is only available to users with the **Security Administrator** role.
65+
66+
### Create the agent's identity and assign permissions
67+
68+
The Phishing Triage Agent operates in the context of the identity you associate with it. Creating the agent's identity and assigning the appropriate permissions to the agent is the required before starting the setup.
69+
70+
#### Identity
71+
72+
The Phishing Triage Agent uses as identity to access the data it needs to perform its tasks. For the agent, Microsoft recommends creating a **Microsoft Entra user** in the Microsoft Entra admin center and assigning the user the **Security Reader** role.
73+
74+
> [!TIP]
75+
> Microsoft recommends creating and using a dedicated user account for the agent with the minimum required permissions.
76+
> When creating the user account, ensure to assign a distinct display name, for example *Phishing triage agent*, to help identify the account in the Microsoft Defender portal.
77+
78+
Once the user is created, you can connect it to an existing user account that has the required permissions. In the initial setup, you can select **Connect an existing user account** to connect the agent to a user account and sign in to the user account.
79+
80+
Connecting the agent to a user account requires authentication that expires after 90 days. You must reauthenticate the agent every 90 days to maintain its access.
81+
82+
#### Permissions
83+
84+
After creating the agent's identity, you must assign it the appropriate permissions to access the data it needs to perform its tasks. To assign a role, see [Create a custom role](create-custom-rbac-roles.md#create-a-custom-role).
6585

6686
The Phishing Triage Agent requires the following permissions to run:
6787

@@ -71,101 +91,103 @@ The Phishing Triage Agent requires the following permissions to run:
7191
- Security Copilot (read)
7292
- Alerts (manage)
7393

74-
### Identity
94+
> [!TIP]
95+
> Microsoft recommends setting the agent with the aforementioned minimum required permissions.
96+
> Users who have the same permissions as the agent can monitor the agent and view its output. However, they cannot manage the agent or change its settings.
7597
76-
The Phishing Triage Agent requires an identity to run. You can connect it to an existing user account that has the required permissions. Connecting the agent to a user account requires authentication that expires after 90 days. You must reauthenticate the agent every 90 days to maintain its access.
98+
### Begin the setup
7799

78-
> [!TIP]
79-
> Microsoft recommends creating and using a dedicated user account for the agent with the minimum required permissions.
100+
Once the agent's identity is created and the appropriate permissions are assigned, you can begin the setup process.
80101

81-
### Products
102+
You can access the Phishing Triage Agent setup from the **Incidents** queue in the Microsoft Defender portal. Select **Set up** to start the setup process.
82103

83-
The tenant must have Microsoft Defender for Office 365 with *Monitor reported messages in Outlook* and submissions alert policy turned on.
104+
[SCREENSHOT]
84105

85-
### Plugins
106+
You can also access the Phishing Triage Agent setup from the **Settings > Microsoft Defender XDR** page in the Microsoft Defender portal. Under **Agents**, select **Overview**, then select **Set up** to start the setup process.
86107

87-
The following plugins must be enabled in Security Copilot:
108+
[SCREENSHOT]
88109

89-
- Microsoft Defender XDR
90-
- Microsoft Threat Intelligence
91-
- Phishing Triage Agent
110+
Follow the steps in the setup wizard to complete the setup. The setup process includes the following steps:
92111

93-
## Set up and manage the Phishing Triage Agent
112+
1. Select the identity to assign to the agent.
113+
2. Follow the prompts to sign in to the user account you want to connect to the agent.
94114

95-
> [!NOTE]
96-
> Setup and management of the Phishing Triage Agent is only available to users with the **Security Administrator** role.
115+
[SCREENSHOT]
97116

98-
To set up the Phishing Triage Agent, follow these steps:
117+
3. Select **Deploy agent** to set up the agent.
99118

100-
1. Sign in to the Microsoft Defender portal as a Security Administrator and navigate to the incidents queue.
119+
> [!NOTE]
120+
> You can change the agent's identity and role at any time. To do this, navigate to **Settings > Microsoft Defender XDR**. Under **Agents**, select **Identity and role**.
101121
102-
2. Look for the Phishing Triage card above the queue, then select **Set up agent**.
122+
4. Select **View incidents** to navigate to the incidents queue. The Phishing Triage Agent is now set up and running in the background, ready to triage user-submitted phishing incidents.
103123

104124
[SCREENSHOT]
105125

106-
3. In the **Overview** page of Agents settings, select **Set up** to start the setup process.
126+
### Troubleshooting setup issues
107127

108-
4. Read the information about the Phishing Triage Agent and select **Set up**.
128+
If you encounter issues during the setup process, check the following:
109129

110-
[SCREENSHOT]
130+
- Ensure that the agent's identity has the required permissions to access the data it needs to perform its tasks.
131+
- Ensure that you have the necessary permissions to set up the agent. You must have the **Security Administrator** role to manage the agent.
132+
- Ensure that the tenant has the required products enabled to use the agent. The tenant must have Microsoft Defender for Office 365 Plan 2 and must be provisioned with access to Security Copilot.
133+
- Ensure that the Microsoft Defender required features are enabled in your organization. Unified role-based access control (URBAC) must be enabled, and the alert policy **Email reported by user as malware or phish** must be turned on.
111134

112-
5. Connect the agent to an identity for the agent to run with the required permissions. Select **Connect an existing user account** for the agent to run in the context of the identity you associate with it. Select **Continue**.
135+
## Manage the Phishing Triage Agent
113136

114-
6. Select **Assign user** and follow the prompts to sign in to the user account you want to connect to the agent.
137+
The Phishing Triage Agent's settings can be managed from the **Settings > Microsoft Defender XDR** page in the Microsoft Defender portal.
115138

116-
[SCREENSHOT]
139+
### Manage the agent settings
117140

118-
7. After signing in, assign the identity an appropriate role to grant it the required permissions. To create a role and manage the agent's access, see [Create a custom role](create-custom-rbac-roles.md#create-a-custom-role).
141+
You can manage the agent settings from the **Overview** page under **Agents**. The following options are available:
119142

120-
8. Select **Deploy agent** to create the agent identity.
121-
122-
9. Select **View incidents** to navigate to the incidents queue. The Phishing Triage Agent is now set up and running in the background, ready to triage user-submitted phishing incidents.
143+
- **Pause**: Temporarily pause the agent. The agent will not triage new incidents while paused.
144+
- **Remove agent**: Permanently remove the agent. The agent will no longer triage new incidents, but it retains the history of all incidents it triaged.
123145

124146
[SCREENSHOT]
125147

126-
To manage the Phishing Triage Agent, follow these steps:
127-
128-
1. Select **Manage agent** in the agent card above the incident queue. Alternatively, you can navigate to **Settings > Microsoft Defender XDR**.
148+
### Manage the agent identity and role
129149

130-
2. Under **Agents**, select **Overview**. You can manage the agent by selecting **Pause** or **Remove the agent**.
150+
You can manage the agent's identity and role from the **Identity and role** page under **Agents**. In this page, you can view the agent's identity, last update information, and the option to select a different identity for the agent.
131151

132152
[SCREENSHOT]
133153

134-
3. Under **Identity and role**, you can view the agent's identity, last update information, and the option to select a different identity for the agent.
154+
### Manage feedback to the agent
135155

136-
[SCREENSHOT]
156+
You can manage feedback provided to the agent from the **Agent Feedback** page under **Agents**. In this page, you can view all the feedback provided to the agent, including the agent's lesson, agent classification, classification change, users who provided feedback, the date of the feedback, and the incident ID.
137157

138-
4. Under **Agent feedback**, you can view all the feedback provided to the agent, including the agent's lesson, agent classification, classification change, users who provided feedback, the date of the feedback, and the incident ID.
139-
140-
[SCREENSHOT]
158+
[SCREENSHOT]
141159

142-
5. To review each feedback, select the feedback item from the list. In the **Review feedback** pane, review the details and decide to keep or reject the feedback. If you keep the feedback, the agent continues to use the feedback to improve its classification. If you reject the feedback, select **Reject feedback**.
160+
To review each feedback, select the feedback item from the list. In the **Review feedback** pane, review the details and decide to keep or reject the feedback. If you keep the feedback, the agent continues to use the feedback to improve its classification. If you reject the feedback, select **Reject feedback**.
143161

144-
[SCREENSHOT]
162+
[SCREENSHOT]
145163

146-
## Assess and provide feedback on the agent's output
164+
## Working effectively with the Phishing Triage Agent
147165

148166
Once the Phishing Triage Agent is fully setup and running, it's triggered when a user in your organization submits a phishing incident. The agent automatically analyzes email content, classifying the incident as either phishing or not phishing based on its training and the context of the organization.
149167

150-
Users can review the Phishing Triage Agent's triaged incidents, provide feedback on the actions taken by the agent, and assess the agent's overall performance in terms of total incidents resolved and mean time to resolve.
168+
Users can review the Phishing Triage Agent's triaged incidents and continuously enhance the agent's learning capabilities by providing feedback on the actions taken by the agent.
151169

152-
### Review triaged incidents
170+
### Reviewing the agent's triaged incidents
153171

154-
After setting up the Phishing Triage Agent, it automatically runs in the background and begins to triage user-submitted phishing incidents. You can filter the queue for incidents with the **Agent** tag to view the incidents triaged by the agent.
172+
After setting up the Phishing Triage Agent, it automatically runs in the background and begins to triage user-submitted phishing incidents. You can review your incident queue to see all the phishing incident submissions that the agent has swiftly resolved. Filter the queue for incidents with the **Agent** tag to view the incidents triaged by the agent.
155173

156174
[SCREENSHOT]
157175

158-
Select an incident to review. In the incident page, look for the Phishing Triage Agent activity in the Copilot side panel.
176+
To see how the agent triaged and classified a phishing incident, select an incident from the queue to review. In the incident page, look for the Phishing Triage Agent card in the Copilot side panel.
159177

160178
[SCREENSHOT]
161179

162-
### Provide feedback to the agent
180+
The Phishing Triage Agent card provides a classification verdict and the reasoning behind it using natural language, simplifying the process of understanding the agent's decision-making.
181+
182+
### Refining the agent through contextual feedback
183+
184+
You can provide feedback to the Phishing Triage Agent to help it learn and improve its classification accuracy. This feedback is essential for the agent to adapt to your organization's specific context and enhance its performance over time.
163185

164-
Review the agent's classification verdict and reason. If the agent's classification does not align with your parameters, select **Change classification**.
186+
If the agent's classification does not align with your criteria, select **Change classification** in the Phishing Triage Agent card.
165187

166188
[SCREENSHOT]
167189

168-
Selecting this option opens the Manage alert pane where you can provide the classification and add comments. You can explain your reasoning to the agent using natural language. Once you’re done, select **Use this feedback to teach the agent option** to improve the agent's subsequent responses so they’re better aligned with your organization’s context.
190+
Selecting this option opens the Manage alert pane where you can change the classification and add additional context through comments using natural language. Select **Use this feedback to teach the agent option** to improve the agent's subsequent responses so they’re better aligned with your organization’s context.
169191

170192
[SCREENSHOT]
171193

‎defender-xdr/security-copilot-in-microsoft-365-defender.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,9 @@ Ask Copilot to summarize the relevant threats impacting your environment, to pri
127127

128128
### Security Copilot agents in Microsoft Defender
129129

130+
> [!IMPORTANT]
131+
> Some information in this article relates to a prereleased product, which may be substantially modified before it's commercially released. Microsoft makes no warranties expressed or implied, with respect to the information provided here.
132+
130133
#### Phishing Triage Agent
131134

132135
The [Phishing Triage Agent](phishing-triage-agent.md) is a Security Copilot agent designed to scale security teams' response in triaging and classifying user-submitted phishing incidents in Microsoft Defender, can help organizations address phishing efficiently. It assists security operations center (SOC) teams by autonomously triaging phishing submissions, determining whether they are genuine phishing attempts or false alarms. By alleviating the burden of reactive work, it reduces the team's manual workload and allows them to focus on critical tasks.

0 commit comments

Comments
 (0)