Question

During an active multi-stage incident in Microsoft Defender XDR, your SOC lead asks you to produce a written, shareable summary of the incident that includes an executive-readable narrative of what happened, the affected assets, and the actions already taken — so it can be attached to the incident ticket for management review. You are using the embedded Microsoft Security Copilot experience within the Defender portal. Which Copilot capability should you use to generate this deliverable most efficiently?

Accepted Answer

Run the 'Incident summary' capability in the embedded Security Copilot panel on the incident, then copy the generated summary into the incident's activity log or export it

Answer

Open the KQL advanced hunting query assistant and ask Copilot to write a query that returns all incident-related events

Answer

Use the 'Guided response' recommendations and screenshot each suggested remediation step for the report

Answer

Trigger a device investigation package collection from the primary affected endpoint and attach the resulting archive to the ticket