{"id":7935,"date":"2024-06-20T12:27:43","date_gmt":"2024-06-20T10:27:43","guid":{"rendered":"https:\/\/jeffreyappel.nl\/?p=7935"},"modified":"2024-06-20T12:27:45","modified_gmt":"2024-06-20T10:27:45","slug":"how-to-onboard-and-getting-started-with-copilot-for-security","status":"publish","type":"post","link":"https:\/\/jeffreyappel.nl\/how-to-onboard-and-getting-started-with-copilot-for-security\/","title":{"rendered":"How to onboard and getting started with Copilot for Security"},"content":{"rendered":"\n

Microsoft Copilot for Security is a new tool based on AI, it takes signals from various sources to use the data as additional input and research layer. Microsoft Copilot for Security is integrated into a specialized language model that includes security graph data. <\/p>\n\n\n\n

Microsoft Copilot for Security was recently announced and available for customers in the public stage, it is no longer part of the private preview – which means it can be enabled easily in customer tenants – of course; it will cost money to run Microsoft Copilot for Security. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Microsoft Security Copilot is an AI-enabled cybersecurity solution that processes signals and correlates events with multiple sources. Copilot for Security leverages GPT-4, which is developed and trained by OpenAI. On top of the OpenAI layer is the Microsoft security model that includes trillions of daily security signals. <\/p>\n\n\n\n

Logical architecture<\/strong><\/h3>\n\n\n\n

The following logical architecture shows the sources and service architecture as part of Microsoft Copilot for Security. Good to know, that each Microsoft security product with a copilot experience only provides access to the data set associated with the products. Copilot for Security provides access to all the data sets to which the user has access. When the user has only Defender XDR, it will include access to the Defender XDR data and not Microsoft Entra of Microsoft Intune. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Image source: Microsoft<\/a><\/p>\n\n\n\n

\n\n\n\n

How does Microsoft Copilot for Security work?<\/strong><\/h2>\n\n\n\n

Microsoft Copilot for Security is based on a user prompt. As seen in the above screenshot it works in the following order:<\/p>\n\n\n\n

    \n
  1. User prompts from Security products are sent to Security Copilot (Input)<\/li>\n\n\n\n
  2. Security Copilot accesses Plugings for pre-processing<\/li>\n\n\n\n
  3. Security Copilot sends a modified prompt to LLM<\/li>\n\n\n\n
  4. Security Copilot receives LLM response<\/li>\n\n\n\n
  5. Security Copilot accesses Plugings for post-processing <\/li>\n<\/ol>\n\n\n\n

    The Copilot exchanges the user’s plugin to leverage security-specific skills, which include a specific set of cyber skills or threat intelligence data. <\/p>\n\n\n\n

    \n\n\n\n

    Setting up Microsoft Copilot for Security<\/strong><\/h2>\n\n\n\n

    Microsoft Copilot for Security is Generally Available as of April 1, 2024. Microsoft Copilot for Security is available from the standalone experience or embedded in Defender XDR as part of the integration with security.microsoft.com (Defender XDR). <\/p>\n\n\n\n

    Prerequisites<\/strong><\/h3>\n\n\n\n

    First of all; we need some prerequisites before we can enable Microsoft Copilot for Security:<\/p>\n\n\n\n