Microsoft Copilot for Security Cheat Sheet

• An AI-powered cybersecurity assistant that helps security teams investigate, respond to threats, and manage risks more efficiently.
• Built on Microsoft’s security stack and large language models, it enhances analyst workflows with natural language understanding.
• Reduces time to resolution by summarizing incidents, generating KQL/PowerShell scripts, and providing guided response actions.
• Delivers real-time threat analysis and contextual insights via embedded Copilot experiences or standalone chat.
• Integrates with Defender XDR, Sentinel, Intune, Entra, Purview, Defender for Cloud, and third‑party plugins to provide unified analysis and response.

Key Features

• Incident summarization & triage
  Automatically generates actionable summaries of alerts and incidents by combining internal telemetry with Microsoft threat intelligence.
• Natural‑language threat hunting
  Analysts can write plain‑English prompts; Security Copilot generates or refines KQL queries in Microsoft Sentinel to support investigation workflows.
• Script reverse‑engineering & guidance
  Analyzes PowerShell, Bash, or batch scripts in incidents and explains potential outcomes or malicious behavior.
• Embeddable & standalone experiences
  Copilot can be used within security tools (embedded) or via a standalone chat-like portal, depending on role and context.
• Guided response automation
  Produces remediation recommendations or scripts to automate responses (e.g. via Logic Apps or PowerShell).
• Agent-based automation
  It supports agents, which are automated and adaptive AI workflows that reduce repetitive tasks while analysts remain in control.

Use Cases

• Summarize and triage high-volume incidents across Microsoft Defender and Sentinel
• Investigate suspicious scripts or automation artifacts during incident response
• Generate, refine, or optimize KQL hunting queries
• Produce remediation guidance and playbook scripts (e.g. PowerShell, Logic Apps)
• Identify lateral movement and affected asset relationships
• Create executive summaries or incident reports
• Simulate attack scenarios for blue team training
• Ask Copilot policy‑related prompts for Entra, Intune, and Purview configurations

Integrations with other Azure services

Some important terminologies

• Promptbook: Collections of tailored prompts for common security workflows like triage, hunting, or reporting.
• Plugin or Connector: Extends Copilot with data from Microsoft or third‑party security tools (e.g., Sentinel, external threat intel)
• Security Compute Unit (SCU): A billing and capacity unit; Copilot usage is managed via provisioned or overage SCUs.
• Agent: Automated, adaptive AI workloads that perform high-volume security tasks under analyst supervision—improving efficiency while preserving human control.
• Prompting: Natural language input given to Security Copilot to generate KQL queries, remediation instructions, or investigative summaries.
• Workspace: A container within Microsoft Security Copilot that defines access boundaries, data sources, and plugin configurations.

Pricing

Consumption-Based SCU Billing

• Security Compute Units (SCUs) drive all Security Copilot usage. You pay for both the standalone portal and embedded experiences via SCUs. Pricing is standard across regions and delivery modes.
  • Provisioned SCUs: Fixed compute capacity billed hourly ($4 per SCU/hour). Requires a minimum of 1 SCU per hour reserved 24×7 for continuous operations.
  • Overage SCUs: Automatically used when demand exceeds provisioned capacity. Billed at approximately $6 per SCU/hour, only charged for what’s consumed during spikes. Overage can be capped to control spend.

Usage Monitoring & Optimization

• Use the Security Copilot dashboard to monitor provisioned vs. overage SCU usage, plugins invoked, and session initiators over the last 90 days.
• Billing is calculated in hourly blocks for provisioned capacity (rounded up per hour). Overage usage is billed precisely, typically up to one decimal place.

Microsoft Copilot for Security Cheat Sheet Resources:

https://learn.microsoft.com/en-us/copilot/security/microsoft-security-copilot
https://learn.microsoft.com/en-us/copilot/security/get-started-security-copilot
https://azure.microsoft.com/en-us/pricing/details/microsoft-security-copilot/