A phishing report lands. The analyst spends the first twenty minutes finding the incident, identity, device, and script records that belong together. Security Copilot can gather that context, draft a timeline, and suggest checks for the analyst to consider.
This module is about using that head start without handing over judgment. You'll see where Security Copilot fits, which boundaries an investigation crosses, and how a bounded prompt keeps evidence separate from interpretation. You'll also work with its embedded experiences in Defender, Sentinel, Entra, and Purview. The final lesson covers Microsoft's fifteen ready-made security agents, safe boundaries for custom agents, and the different paths toward SC-200 and SC-500.
Security Copilot is an intermediate product aimed at SOC work. Full use assumes the right security licenses and real telemetry, but you can learn the reasoning without your own tenant through Microsoft's guided simulations. Throughout the module, treat a fluent answer as a draft. Confirm the underlying evidence before anyone acts on it.
What you'll walk away with
Describe what Security Copilot does and the boundaries every investigation crosses
Write bounded security prompts and pick the right built-in promptbook
Investigate incidents with Security Copilot embedded in Defender, Sentinel, Entra, and Purview
Classify a finding as confirmed, plausible, or unknown before you act on it
Choose and supervise a ready-made security agent, and know when to build your own instead
Map a realistic path toward the SC-200 or SC-500 certification
