Blog Post

Microsoft Security Copilot Blog
4 MIN READ

Identity forensics with Copilot for Security Identity Analyst Plugin

Hesham_Saad's avatar
Hesham_Saad
Icon for Microsoft rankMicrosoft
Oct 24, 2024
Overview This is a step-by-step guided walkthrough of how to use a custom KQL Copilot for Security plugin for Identity SOC and forensics use cases and how it helps in implementing a consistent secu...
Updated Oct 24, 2024
Version 1.0
prompting
security operations
Jason_Revill's avatar
Jason_Revill
Copper Contributor
Oct 28, 2024

Many thanks for the Plugin. Initial tests have had some good results. One piece of feedback is that I've found it to be extremely hungry from an SCU perspective. One prompt for Get User Risk Assessment is driving north of 3 SCUs. This is something to consider in case it can be further optimised.👍