Microsoft’s Security Agents Are Eating the SOC: Here’s How to Deploy AI That Triages Threats While You Sleep + Video

By /

Listen to this Post

Featured Image

Introduction:

The modern Security Operations Center (SOC) is drowning in alerts but starving for context. Microsoft’s answer is the Security Store—a marketplace of task‑specific, partner‑built AI agents that natively integrate with Defender, Sentinel, Entra, Purview, and Intune. These agents don’t just enrich data; they autonomously reason, correlate signals across the Microsoft security graph, and execute governed remediation steps. For SOC analysts, this shifts the paradigm from tool‑swiveling to agent‑augmented decision making.

Learning Objectives:

  • Understand the architecture and deployment workflow of Microsoft Security Agents via the Security Store.
  • Learn how to configure and automate incident triage using Security Copilot and partner‑built agents.
  • Gain hands‑on experience with PowerShell, KQL, and Graph API commands to operationalize AI‑driven security workflows.

You Should Know

  1. Deploying Your First Security Agent from the Microsoft Security Store
    The Microsoft Security Store is the centralized hub for discovering, deploying, and managing Security Agents. These agents appear as first‑class citizens inside Microsoft 365 Defender, Sentinel, and even Teams for collaboration.

Step‑by‑step deployment guide:

  1. Navigate to the Security Store: https://lnkd.in/gYvZyNBK (sign in with a Global Admin or Security Admin account).
  2. Use filters to find agents by category (e.g., Threat Intelligence, Identity Hardening, Compliance).
  3. Click “Get it now” on an agent (e.g., a partner‑built phishing triage agent).
  4. Review the required permissions – typically SecurityEvents.ReadWrite.All, Alert.ReadWrite.All, and Incident.ReadWrite.All.
  5. Accept the terms and assign the agent to a specific Microsoft Entra ID group (e.g., “SOC‑Level1”).
  6. Once deployed, the agent appears in the Security Copilot plugins panel.

Verify deployment with Microsoft Graph PowerShell:

 Connect to Microsoft Graph with required scopes
Connect-MgGraph -Scopes "SecurityIncident.Read.All", "SecurityActions.Read.All"

List all deployed Security Agents in the tenant
Get-MgSecurityPartnerSecurityAlert | ? { $_.AdditionalProperties."@odata.type" -eq "microsoft.graph.securityPartnerAgent" }
  1. Automating Alert Triage with Security Copilot and Custom Prompts
    Security Agents are not static—they respond to natural language prompts inside Security Copilot. Analysts can now ask “What is the blast radius of this ransomware incident?” and the agent autonomously queries endpoints, identity logs, and email traces.

How to build a custom triage prompt:

1. Open Microsoft 365 Defender > Security Copilot.

  1. Enable the partner‑deployed agent via the plugin icon.

3. Use a structured prompt like:

@PhishingAgent Investigate incident 12345. Extract all URLs from the email, check reputation via VirusTotal, and list all users who received the same email in the last 24 hours.

4. The agent returns a collapsible report with enriched data and suggested actions.

Automate this via API:

 Using Microsoft Graph API with an access token
POST https://graph.microsoft.com/v1.0/security/copilot/agents/query
Authorization: Bearer {token}
Content-Type: application/json

{
"agentId": "phishing-agent-001",
"prompt": "Incident 12345: extract URLs, check reputation, identify recipients"
}

Response includes enriched JSON output – ideal for feeding into SOAR playbooks.

3. KQL‑Driven Threat Hunting Augmented by Security Agents

Security Agents can generate KQL (Kusto Query Language) queries on the fly, saving analysts hours of manual hunting. They understand the schema of Advanced Hunting in Defender and Log Analytics workspaces in Sentinel.

Example: Using an agent to hunt for suspicious logons
Instead of writing a complex join, an analyst types:

“Show me all interactive logons from non‑corporate IPs in the last 4 hours, excluding known VPN egress ranges.”

The agent converts this into KQL:

DeviceLogonEvents
| where Timestamp > ago(4h)
| where LogonType == "Interactive"
| where isnotempty(RemoteIP)
| evaluate ipv4_lookup('VPN-Whitelist', RemoteIP, return_unmatched = true)
| where _ind_match == false
| project Timestamp, AccountUpn, DeviceName, RemoteIP, Country = geo_info_from_ip_address(RemoteIP).country
| top 100 by Timestamp desc

Pro tip: Use `.explain` in Copilot to view the generated KQL, then fine‑tune it for production detection rules.

  1. Hardening Identity with Entra ID Protection and an Identity Security Agent
    Identity‑focused Security Agents continuously monitor risk events and autonomously apply conditional access policies. One partner agent, “Identity Shield,” detects impossible travel anomalies and automatically enforces a “require compliant device” policy for affected users.

Step‑by‑step configuration:

1. Deploy “Identity Shield” from the Security Store.

2. Grant it `IdentityRiskEvent.Read.All` and `Policy.ReadWrite.ConditionalAccess`.

  1. Define a risk policy inside the agent’s settings:

– Trigger: `medium+ risk` AND unfamiliar sign‑in properties.
– Action: Block sign‑in or Require MFA reauthentication.

Verify with Azure CLI:

 List conditional access policies modified by the agent
az rest --method get --uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" --headers "Content-Type=application/json" | jq '.value[] | {id, displayName, modifiedDateTime}'

The agent’s modifications appear with `modifiedDateTime` timestamps matching the incident timeline.

  1. Compliance Automation via Purview and AI‑Driven Data Classification
    Security Agents in Microsoft Purview automate the discovery and labeling of sensitive data. A partner agent, “Compliance Guardian,” monitors SharePoint Online and OneDrive for business for overshared files containing PII.

Deployment & test:

1. Install “Compliance Guardian” from the Security Store.

2. Assign the `RecordsManagement.ReadWrite.All` permission.

  1. Create a sensitivity label (e.g., “Confidential – Financial”) if not already present.
  2. The agent automatically applies the label to files matching regex patterns (credit card numbers, SSNs).

Simulate a file sharing event and verify labeling:

 Use SharePoint Online PnP PowerShell
Connect-PnPOnline -Url https://yourtenant.sharepoint.com/sites/finance
Set-PnPFileCheckedOut -Url "/sites/finance/Shared Documents/Budget2025.xlsx"
Set-PnPFileSensitivityLabel -Url "/sites/finance/Shared Documents/Budget2025.xlsx" -LabelId "f42a3342-8706-4288-bd31-ebb85995028z"

After a few minutes, query Purview activity explorer to confirm the agent’s action:

`Search-UnifiedAuditLog -Operations “FileSensitivityLabelApplied” -UserIds “system@sharepoint”`

  1. Simulating an Attack to Validate Agent Response
    Before relying on Security Agents in production, SOC teams must validate their behavior in a controlled environment. Using Microsoft 365 Defender’s Attack Simulator, you can trigger real‑world scenarios and observe agent remediation.

Simulate a credential harvest attack:

  1. Go to Microsoft 365 Defender > Attack simulation training.

2. Create a new simulation: Credential Harvest.

  1. Target a test user in the agent‑monitored group.

4. The agent should automatically:

  • Quarantine the malicious email.
  • Disable any forwarding rules created by the user.
  • Raise an incident with severity High.

Check agent actions via PowerShell:

 Get incidents associated with the simulation
$incidents = Get-MgSecurityIncident -Filter "assignedTo eq 'IdentityShieldAgent'"
$incidents | Format-Table DisplayName, Severity, Status

If the agent fails to act, review its permissions and ensure the simulation triggers are included in its detection scope.

  1. Building Your Own Security Agent with Microsoft Security Copilot
    For partners and advanced enterprises, Microsoft provides a framework to build custom agents using Security Copilot’s skills and plugins. The video by KC Li and Preeti Krishna walks through the end‑to‑end process.

High‑level steps to build a custom agent:

  1. Access the Security Copilot Plugin Studio in Azure AI Studio.
  2. Define an API specification (OpenAPI 3.0) for your agent’s logic.
  3. Write the agent’s natural language description and intended prompts.
  4. Publish the agent to your organization’s Security Store (private visibility).

Example OpenAPI snippet for a “HashReputation” agent:

paths:
/reputation:
get:
summary: "Retrieve threat reputation for a file hash"
parameters:
- name: hash
in: query
required: true
schema: { type: string }
responses:
'200':
description: "Reputation score and associated malware family"

Once published, the agent responds inline: “Hash `e3b0c442…` is known as Trickbot, detected by 8 vendors.”

What Undercode Say:

  • Key Takeaway 1: Security Agents are not simple chatbots—they are permissioned, autonomous workers that execute complex workflows within the Microsoft security stack, dramatically reducing mean‑time‑to‑respond.
  • Key Takeaway 2: The Microsoft Security Store transforms partners from vendors into integrated extensions of the SOC, enabling specialized detection logic to be deployed without months of integration engineering.

Analysis:

The shift to agentic AI in the SOC represents a fundamental re‑architecting of how threat detection and response are delivered. Analysts are no longer data assemblers; they become supervisors of intelligent processes. However, this introduces new risks: misconfigured agent permissions can become attack paths, and over‑reliance on “black box” reasoning may hide subtle false negatives. SOC leads must implement strict governance—least privilege for agents, continuous audit trails, and human‑in‑the‑loop for high‑impact remediation. The Microsoft Security Store is only the beginning; we will soon see cross‑platform agents that orchestrate across AWS, GCP, and on‑premises environments using the same natural language interface.

Prediction:

Within 18 months, 40% of large enterprises will deploy at least five distinct Security Agents in production. This will catalyze a new category of security incidents: agent‑on‑agent poisoning, where adversaries feed crafted telemetry to manipulate an agent into disabling protections or exfiltrating data. The race will shift from endpoint detection to secure, verifiable AI workflows—ushering in the era of AI red teaming as a mandatory SOC discipline.

▶️ Related Video (72% Match):

🎯Let’s Practice For Free:

IT/Security Reporter URL:

Reported By: Harish Aitharaju – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: