Alert analysis
Help analyse alerts and set priority. Selected agents can classify certain alert types automatically.
Sales hook. How many alerts a day does the team still triage by hand?
Solutions · Cybersecurity
It works as a standalone solution and through experiences embedded in Microsoft Security products.
Capabilities
Context, summaries, and recommendations, with less manual work. The data in scope depends on integrations, plugins, permissions, and the products the customer owns.
Help analyse alerts and set priority. Selected agents can classify certain alert types automatically.
Sales hook. How many alerts a day does the team still triage by hand?
Hunt in natural language, generate KQL, interpret results, and add context.
Sales hook. How long does it take today to write and tune a KQL query for a new lead?
Summaries, context, and recommended steps. A person should review the answer before anyone acts on it.
Sales hook. How long does it take to assemble full incident context from several consoles?
Agents for phishing classification, vulnerability prioritisation, and a first look at alerts. Manual or automatic, depending on permissions.
Sales hook. Which repetitive SOC task slows the response the most?
Faster review of malicious or suspicious scripts and command lines, with an explanation of what they do.
Sales hook. How many suspicious scripts a week are waiting for a manual review?
FAQ
An AI solution that helps security and IT teams detect, investigate, and respond. It combines AI models with security plugins, the organisation’s data, trusted sources, and Microsoft’s global threat intelligence. Access is limited by the user’s permissions and the active integrations.
Including Microsoft Defender XDR, Microsoft Sentinel, Microsoft Intune, Microsoft Entra, Microsoft Purview, Microsoft Defender for Cloud, and selected third-party tools such as ServiceNow. Availability depends on the products, plugins, and configuration the customer has.
Security Copilot uses Security Compute Units (SCU). Eligible Microsoft 365 E5 and E7 customers receive a defined pool of SCU with the license. Others need paid SCU capacity. The exact cost depends on the license, the capacity model, and usage. Check it with Promise Group.
No. It automates repetitive work and speeds analysis. It still needs management, configuration, and oversight. Agents can run selected tasks automatically. The team keeps control of their scope.
Promise Group helps you choose SCU capacity, integrations, and a deployment scenario.
We will plan a Security Copilot deployment in the customer’s environment.