A challenge Security Operations Centers (SOCs) experience is that there is a wealth of knowledge and information that is needed to perform at a high level within a timely manner.

How does Copilot help?

A great mentor expands analyst’s knowledge base.

• Can ask specific questions.
• Can explain a vast number of different topics in terms analysts can understand.
• Allow analysts to work on incident types that they would normally not be able to due to lack of understanding.

Security analysts regularly see similar and/or the same incidents that they need to review daily. These are investigated in the same way, collecting certain pieces of information which require time and attention.

How does Copilot help?
Copilot utilizes Promptbooks that will allow analysts of any skill range to investigate incidents in a similar manner.

• Raises the skill bar of all analysts.
• Manually run a promptbook that has the information needed when a specific incident triggers.
• Analysts can quickly analyze the data to determine if the incident is malicious or benign.
• Cuts down investigation time.

Instead of an analyst spending hours researching and writing KQL queries, analysts can ask Copilot to write the query.

How does Copilot help?

• Save a lot of time.
• Help lower the SOC Mean Time to Resolution.
• Allow analysts to focus more on the investigations.
• Raise the skill floor/ceiling of analysts.

Not all analysts have knowledge of the different scripting languages that malware uses; gaining these skills is time intensive and finding the proper learning resources can be difficult.

How does Copilot help?

• Can coordinate the analysis of obfuscated scripts with Defender XDR and a SOC analyst.
• Speed up the incident response time.
• Having the breakdown of each command will allow new Indicators of Compromise vs. Tactics, Techniques, and Procedures (IOC/TTPs) identified and analysts to implement these as Indicators in Defender.

If a certain threat actor is targeting an organization, it is helpful to find intel on the threat groups. 

This can be difficult and time consuming to find threat intel.

How does Copilot help?

• Built-in threat intel will allow analysts to respond quickly to targeted attacks.
• Asking Copilot for TTPs for the specific group.
• TTPs they can be used for hunting + creating detection rules.

Analysts might not have the skillset to write incident reports for non-technical people (c-suite, managers, etc.).

How does Copilot help?

• Capability of writing reports at any knowledge level.
• Write reports significantly faster than a human.
• Easily tailored reports based on client needs.

Security Analysts use a wide breadth of tools to do their job.

How does Copilot help?

Adding plug-ins to Copilot will allow all analysts to have access to different tools straight from the platform. For example: VirusTotal or abusedDB.