Question

A SOC analyst is triaging a high-severity multi-stage incident in the Microsoft Defender portal that spans a compromised mailbox, a suspicious sign-in, and a device with a malicious process. The analyst opens the embedded Microsoft Security Copilot experience within the incident. Which capability does the embedded Copilot provide to help the analyst act on this incident most efficiently?

Accepted Answer

It generates a natural-language incident summary and suggests guided response steps that the analyst can review and act on within the incident.

Answer

It automatically isolates all affected devices and disables the user without analyst confirmation, replacing the need for manual response actions.

Answer

It creates a new Sentinel scheduled analytics rule based on the incident's KQL so future similar activity is detected automatically.

Answer

It exports the incident evidence directly into an eDiscovery case for legal hold and content search.