Security Copilot Essentials
A phishing report lands. The analyst spends the first twenty minutes finding the incident, identity, device, and script records that belong together. Security Copilot can gather that context, draft a timeline, and suggest checks for the analyst to consider.
This module is about using that head start without handing over judgment. You'll see where Security Copilot fits, which boundaries an investigation crosses, and how a bounded prompt keeps evidence separate from interpretation. You'll also work with its embedded experiences in Defender, Sentinel, Entra, and Purview. The final lesson covers Microsoft's fifteen ready-made security agents, safe boundaries for custom agents, and the different paths toward SC-200 and SC-500.
Security Copilot is an intermediate product aimed at SOC work. Full use assumes the right security licenses and real telemetry, but you can learn the reasoning without your own tenant through Microsoft's guided simulations. Throughout the module, treat a fluent answer as a draft. Confirm the underlying evidence before anyone acts on it.
What you'll walk away with
- Describe what Security Copilot does and the boundaries every investigation crosses
- Write bounded security prompts and pick the right built-in promptbook
- Investigate incidents with Security Copilot embedded in Defender, Sentinel, Entra, and Purview
- Classify a finding as confirmed, plausible, or unknown before you act on it
- Choose and supervise a ready-made security agent, and know when to build your own instead
- Map a realistic path toward the SC-200 or SC-500 certification
- 01Security Copilot FundamentalsWhat Security Copilot does, the boundaries every investigation crosses, and how to write a bounded prompt that labels uncertainty instead of guessing.17 min
- 02Embedded in Defender, Sentinel, Entra, and PurviewRoute an investigation to the product that owns the evidence, classify every finding as confirmed, plausible, or unknown, and treat generated KQL and guided response as drafts that require analyst review.15 min
- 03Security Agents and the Agentic SOCChoose Microsoft's ready-made security agents by signal, supervise what they return, build your own with a safe-failure boundary, and map a realistic path to the SC-200 or SC-500 exam.18 min
Live Copilot training for your team
For companies, we deliver the academy material live and build the sessions around your team's own data, tools, and day-to-day work.