Question

During investigation of a multi-stage incident in the Microsoft Defender portal, an analyst opens the embedded Microsoft Security Copilot experience. They want Copilot to help them pivot from a suspicious sign-in to related device events, but the analyst is not fluent in KQL. Which embedded Copilot capability directly addresses this need while keeping the analyst inside the incident context?

Accepted Answer

Use the natural language to KQL (guided hunting) capability, where Copilot converts the analyst's plain-language question into an advanced hunting query they can run and refine

Answer

Trigger an automated investigation from the Action Center so Copilot remediates the sign-in and devices without analyst input

Answer

Export the incident report so Copilot generates a stakeholder summary that includes the required device telemetry

Answer

Open a promptbook to reverse-engineer the malicious script associated with the device alert