You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/security-copilot-describe-agents/includes/1-introduction.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ Imagine you're a security engineer at a mid-sized financial institution. Your te
5
5
In this module, you get an introduction to some of the Microsoft Security Copilot agents, including the Threat Intelligence briefing agent, the Conditional Access Optimization agent, and the Phishing Triage agent.
6
6
7
7
> [!NOTE]
8
-
>This module is intended to give you a flavor of just a few of the Microsoft agents available in Security Coplot, through both the standalone and embedded experience. Agents that are available through the embedded Copilot experience, are described in training that relates to the specific security solution in which it's embedded. For example, agents that are embedded in Microsoft Purview solutions are described in the training that relates to that Microsoft Purview solution.
8
+
>This module is intended to give you a flavor of just a few of the Microsoft agents available in Security Coplot, through both the standalone and embedded experience. Agents that are available through the embedded Copilot experience, are described in training that relates to the specific security solution in which it's embedded. For example, agents that are embedded in Microsoft Purview solutions are described in the training that relates to that Microsoft Purview solution.
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/security-copilot-describe-agents/includes/3-describe-threat-intelligence-briefing-agent.md
+14-14Lines changed: 14 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,31 +16,31 @@ The Threat Intelligence Briefing Agent, which is available through the standalon
16
16
17
17
### Set up
18
18
19
-
Follow these steps to configure the Threat Intelligence Briefing Agent:
19
+
Follow these steps to configure the Threat Intelligence Briefing Agent, corresponding images are shown in the tabbed images that follow:
20
20
21
-
1. Navigate to the **Agents** page in the Microsoft Security Copilot portal and select **View details** under the Threat Intelligence Briefing Agent.
22
-
2. Review the agent details and select **Set up**.
23
-
3. Connect a user account by selecting **Next** and choosing the appropriate account.
24
-
4. Specify parameters to customize the output, such as:
21
+
1.Agents - Navigate to the **Agents** page in the Microsoft Security Copilot portal and select **View details** under the Threat Intelligence Briefing Agent.
22
+
2.Details page - Review the agent details and select **Set up**.
23
+
3.Set up - Connect a user account by selecting **Next** and choosing the appropriate account.
24
+
4.Parameters - Specify parameters to customize the output, such as:
25
25
- Number of insights to research.
26
26
- Look-back period for threats.
27
27
- Email address for report delivery.
28
28
- Geographical region and industry scope.0
29
-
5. After setup, access the agent overview page to run the agent manually or schedule it to run automatically.
29
+
5.Run - After setup, access the agent overview page to run the agent manually or schedule it to run automatically.
30
30
31
-
# [Step 1 - Agents](#tab/agents)
31
+
# [Agents](#tab/agents)
32
32
:::image type="content" source="../media/agents-copilot-v2.png" lightbox="../media/agents-copilot-v2.png" alt-text="Screen capture showing the navigation flow to access the Agents page in Microsoft Security Copilot. ":::
:::image type="content" source="../media/threat-intelligence-agent-setup1.png" lightbox="../media/threat-intelligence-agent-setup1.png"alt-text="Screenshot of Threat Intelligence Briefing Agent set up page that provides information on the permissions and identity needed to run the agent.":::
37
+
# [Set up](#tab/set-up-agent)
38
+
:::image type="content" source="../media/threat-intelligence-agent-setup-1.png" lightbox="../media/threat-intelligence-agent-setup-1.png"alt-text="Screenshot of Threat Intelligence Briefing Agent set up page that provides information on the permissions and identity needed to run the agent.":::
39
39
40
-
# [Step 4 - Parameters](#tab/parameters)
41
-
:::image type="content" source="../media/threat-intelligence-agent-setup2.png" lightbox="../media/threat-intelligence-agent-setup2.png" alt-text="Screenshot of Threat Intelligence Briefing Agent set up parameters page.":::
40
+
# [Parameters](#tab/parameters)
41
+
:::image type="content" source="../media/threat-intelligence-agent-setup-2.png" lightbox="../media/threat-intelligence-agent-setup-2.png" alt-text="Screenshot of Threat Intelligence Briefing Agent set up parameters page.":::
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/security-copilot-describe-agents/includes/4-describe-conditional-access-optimization-agent.md
+16-13Lines changed: 16 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,24 +21,27 @@ The Conditional Access Optimization Agent, which is available in Microsoft Entra
21
21
22
22
Follow these steps to configure and run the Conditional Access optimization agent:
23
23
24
-
1.Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) with at least a Security Administrator role.
25
-
1.From the home page, select **Go to agents** from the agent notification card.
26
-
1.Select **View details** and under the Conditional Access Optimization Agent, then select **Start agent** to being your first run.
27
-
1.When the agent overview page loads, you see most recent and next scheduled runtimes, performance highlights, recent suggestions, and recent activity.
28
-
1. Selecting a suggestion takes you to the policy details page where you can view the agent summary, user impact, policy details, make edits, and more.
24
+
1.Go to agents - Once you sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) with at least a Security Administrator role, from the Microsoft Entra home page, select **Go to agents** from the agent notification card.
25
+
1.Available agents - The Security Copilot agents page, shows tiles for the available agents. The page currently only shows the Conditional Access Optimization Agent, but more agents are coming soon.
26
+
1.Start Agent - In the Conditional Access Optimization Agent tile, select **View details**. If you have not previously run the agent, you'll see the option to **Star agent** to begin the agent's first run.
27
+
1.Overview page - If you have previously run the agent, selecting view details, brings you to the Overview page. The Overview page shows you see most recent and next scheduled runtimes, performance highlights, recent suggestions, and recent activity.
28
+
1.Policy details - Selecting a suggestion takes you to the policy details page where you can view the agent summary, user impact, policy details, make edits, and more.
29
29
1. Newly created policies are created in report-only mode. As a best practice organizations should exclude their break-glass accounts from policy to avoid being locked out due to misconfiguration.
30
30
1. After administrators evaluate the policy settings using policy impact or report-only mode, they can move the Enable policy toggle from Report-only to On. Policies created by the agent are tagged with Conditional Access Optimization Agent in the Conditional Access policies pane.
31
31
32
-
# [Step 2 - Go to agents](#tab/go-to-agents)
33
-
:::image type="content" source="../media/conditional-access-agent-home-page.png" lightbox="../media/conditional-access-agent-home-page.png" alt-text="Screenshot showing the Microsoft Entra home page with the Copilot agent tile.":::
32
+
# [Go to agents](#tab/go-to-agents)
33
+
:::image type="content" source="../media/conditional-access-agent-home-page.png" lightbox="../media/conditional-access-agent-home-page.png" alt-text="Screenshot of the Microsoft Entra home page that includes the agent notification tile.":::
:::image type="content" source="../media/conditional-access-agent-tile.png" lightbox="../media/conditional-access-agent-tile.png" alt-text="Screenshot of the Security Copilot agents page showing that lists available agents.":::
37
37
38
-
# [Step 4 - Overview](#tab/overview)
39
-
:::image type="content" source="../media/conditional-access-agent-overview-page.png" lightbox="../media/conditional-access-agent-overview-page.png" alt-text="Screenshot showing the Conditional Access Optimization Agent overview page showing the most recent and next scheduled runtimes, performance highlights, recent suggestions, and recent activity.":::
38
+
# [Start agent](#tab/start-agent)
39
+
:::image type="content" source="../media/conditional-access-agent-view-details.png" lightbox="../media/conditional-access-agent-view-details.png" alt-text="Screenshot showing the Conditional Access Optimization Agent details page. From here, you can select start if you haven't previously run the agent.":::
40
40
41
-
# [Step 5 - Policy details](#tab/policy-details)
41
+
# [Overview page](#tab/overview-page)
42
+
:::image type="content" source="../media/conditional-access-agent-overview-page-v2.png" lightbox="../media/conditional-access-agent-overview-page-v2.png" alt-text="Screenshot showing the Conditional Access Optimization Agent overview page showing the most recent and next scheduled runtimes, performance highlights, recent suggestions, and recent activity.":::
@@ -49,7 +52,7 @@ The agent is configured to run every 24 hours based on when it's initially confi
49
52
50
53
Use the checkboxes under Objects to specify what the agent should monitor when making policy recommendations. By default the agent looks for both new users and applications in your tenant over the previous 24 hour period.
51
54
52
-
The agent runs under the Identity and permissions of the user who enabled the agent in your tenant. Because of this requirement you should avoid using an account that requires elevation like those that use PIM for just-in-time elevation.
55
+
The agent runs under the Identity and permissions of the user who enabled the agent in your tenant. Because of this requirement, you should avoid using an account that requires elevation like those that use Privileged Identity Management (PIM) for just-in-time elevation.
53
56
54
57
You can tailor policy to your needs using the optional Custom Instructions field. This allows you to provide a prompt to the agent as part of its execution. For example: "The user "Break Glass" should be excluded from policies created." When you save the custom instruction prompt Security Copilot will attempt to interpret and the results appear in the settings page.
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/security-copilot-describe-agents/includes/5-describe-phishing-triage-agent.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,9 +16,9 @@ The Phishing Triage Agent uses advanced large language model (LLM)-based analysi
16
16
The Phishing Triage Agent, which is available in Microsoft Defender XDR as part of the Copilot embedded experience, is characterized as follows:
17
17
18
18
-**Trigger**: The agent is triggered when a user in your organization submits a phishing incident. The agent autonomously analyzes the submitted email to classify them as either phishing or not phishing based on its training and the context of the organization.
19
-
-**Permissions**: This agent can read data from Defender XDR adn Microsoft Threat Intelligence.
19
+
-**Permissions**: This agent can read data from Defender XDR and Microsoft Threat Intelligence.
20
20
-**Identity**: Connection to an existing user account.
21
-
-**Products**: Microsoft Defender for Office 365 Plan 2 and Microsoft Security Copilot with provisioned capacity is necessary to run the agent. The following Microsoft Defender capabilities are required:
21
+
-**Products**: Microsoft Defender for Office 365 Plan 2 and Microsoft Security Copilot with provisioned capacity is necessary to run the agent. The following Microsoft Defender capabilities are required:
22
22
- Unified role-based access control (URBAC) must be enabled for managing permissions.
23
23
- The *Monitor reported messages in Outlook* must be enabled in the User reported settings page.
24
24
- Enable the "Email reported by user as malware or phish" alert policy.
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/security-copilot-describe-agents/includes/7-summary.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,17 +1,17 @@
1
-
In this module, we addressed the challenge of optimizing security workflows and automating repetitive tasks for security engineers. We explored how Microsoft Security Copilot and its specialized agents streamline processes like threat analysis, phishing triage, identity management, and conditional access optimization. By leveraging AI-driven tools and seamless integration with Microsoft Defender and Entra, we demonstrated how these agents enhance efficiency and decision-making in security operations.
1
+
In this module, we addressed the challenge of optimizing security workflows and automating repetitive tasks for security engineers. We explored how Microsoft Security Copilot and its specialized agents streamline processes like threat analysis, phishing triage, identity management, and conditional access optimization. By using AI-driven tools and seamless integration with Microsoft Defender and Microsoft Entra, we demonstrated how these agents enhance efficiency and decision-making in security operations.
2
2
3
-
The techniques learned in this module offer significant advantages, including time savings, improved threat detection, and actionable insights tailored to organizational needs. These capabilities empower security engineers to focus on critical tasks while reducing manual effort and minimizing errors. The business impact includes enhanced security posture, better collaboration across IT workflows, and alignment with Zero Trust principles, ensuring robust protection against evolving threats.
3
+
The techniques learned in this module offer significant advantages including time savings, improved threat detection, and actionable insights tailored to organizational needs. These capabilities empower security engineers to focus on critical tasks while reducing manual effort and minimizing errors. The business impact includes enhanced security posture, better collaboration across IT workflows, and alignment with Zero Trust principles, ensuring robust protection against evolving threats.
4
4
5
5
In this module, you learned about the key functionalities of Microsoft Security Copilot agents, including the Conditional Access Optimization Agent, Phishing Triage Agent, and Threat Intelligence Briefing Agent. You explored how these agents automate tasks like phishing classification, threat intelligence reporting, and identity risk mitigation through optimization of conditional access policies.
6
6
7
-
After completing this module, you are able to:
7
+
After completing this module, you're able to:
8
8
9
9
- Describe the role and functionality of Microsoft Security Copilot agents in automating security workflows.
10
10
- Describe the Threat Intelligence Briefing Agent.
11
11
- Describe the Conditional Access Optimization Agent.
0 commit comments