Respond to Security Incidents · Topic 3 of 5
Agentic AI, Complex Attacks and Case Management
SC-200 advanced response: embedded Security Copilot, multi stage and lateral movement attacks, the incident graph and case management of incidents.
- 6 min
- Security Copilot is embedded in the Defender portal and offers incident summaries, guided response, script and file analysis, KQL generation and reports.
- Always verify AI output, and remember that it follows the user's permissions.
- Multi stage, multi domain and lateral movement attacks are correlated into one incident.
What it is
The hardest incidents are complex attacks that cross email, identities, devices and cloud, and the SOC has more of them than it can read. Three skills help. Agentic AI, including Microsoft Security Copilot embedded in the Defender portal, speeds up triage and investigation. Investigating complex attacks means following multi stage, multi domain and lateral movement activity. Case management keeps the work organised from the first alert to closure.
How it works
Agentic AI and embedded Security Copilot
Microsoft Security Copilot is a generative AI assistant for security. It is embedded in the Defender portal, so analysts get help in the screens they already use, without switching tools.
| Embedded capability | What it does for the analyst |
|---|---|
| Incident summary | Summarises the incident: what happened, which entities are involved and the likely impact |
| Guided response | Suggests next steps, classification and recommended actions for the incident |
| Script and file analysis | Explains what a script or file does, in plain language |
| KQL generation | Turns a natural language question into an advanced hunting query |
| Incident report | Writes a report of the investigation for handover or leadership |
| Device and user summaries | Summarise a device or identity so you can understand it quickly |
Agents go further than answering questions. An agent is an AI component that carries out a task with a degree of autonomy, for example an agent that triages phishing reports and only escalates the real ones. Agents work with the data and tools of the platform, and the SOC reviews and controls them.
Use AI as an assistant, and always verify its output. A summary or a generated query can be wrong, so check the evidence in the incident before acting. Access to Security Copilot depends on capacity and on roles, and what it can see follows the permissions of the person using it.
Investigating complex attacks
Modern attacks are rarely a single alert. Three patterns matter.
| Pattern | Meaning | How you spot it |
|---|---|---|
| Multi stage | The attack moves through several steps, such as phishing, credential theft, then data theft | Alerts from different stages are correlated into one incident, and the attack story shows the order |
| Multi domain | The attack touches several areas, such as email, endpoint, identity and cloud apps | Defender XDR correlates signals from several products |
| Lateral movement | The attacker moves from one machine or account to another | Look for new sign ins from a compromised device, remote execution and pass the ticket or pass the hash alerts |
For these incidents:
- Open the attack story and read the timeline from the first event.
- Identify the entry point, such as the phishing message or the exposed service.
- Follow each entity that is compromised, and look at what else it touched.
- Use the incident graph to see how entities connect, and blast radius analysis to see the paths from a compromised entity to critical assets.
- Contain the spread: isolate devices, disable accounts, block indicators.
- Hunt for the same behaviour elsewhere, using the indicators you found.
- Document findings and update detections so the same technique is caught earlier next time.
Automatic attack disruption may already have contained some assets, and the incident shows which ones. Remember that correlation across products is what turns many small alerts into one incident worth acting on.
Case management
Managing incidents as cases keeps work visible, ordered and auditable.
| Feature | Use |
|---|---|
| Queue and filters | Sort by severity, status, service source, owner and tags to prioritise |
| Assignment | Give each incident an owner so nothing is left unclaimed |
| Status | New, active and resolved, to show progress |
| Tags | Label incidents by campaign, customer or type, so related work can be found |
| Tasks | A checklist of steps for the analyst, which can be added by an automation rule for a given incident type |
| Comments | A running record of what was found and done, for handover |
| Classification and determination | Mark as true positive, informational, or false positive, with a reason such as malware or phishing, which feeds tuning and reporting |
| Activity log | A history of every change to the incident |
| Ticketing integration | Link an incident to a ticket in a service management tool |
Good case handling means every incident has an owner, a status that matches reality, comments that another analyst could follow, and a classification at the end. Resolved incidents with the right classification help tune alerts and prove how the SOC is performing.
Choosing the approach
| The need | Approach |
|---|---|
| A fast summary of a long incident | Security Copilot incident summary |
| Write a hunting query from a plain English question | Security Copilot KQL generation |
| Understand a suspicious script | Script analysis in Security Copilot |
| See how far an attack could spread from one account | Blast radius analysis in the incident graph |
| Make sure each phishing incident follows the same steps | An automation rule that adds tasks |
| Record why an incident was closed | Classification and determination |
A worked scenario
An incident links a phishing email, a stolen token used from a new country, a new inbox rule, and sign ins from the compromised user's workstation to two file servers. The analyst asks the embedded Security Copilot for an incident summary, then opens the attack story to confirm the order of events. The incident graph shows the path from the user to the servers, and blast radius analysis shows a database administrator account in reach. She isolates the workstation, disables the user, resets the administrator credentials and adds tags and comments. Using Copilot, she creates a hunting query for the same inbox rule across the tenant. The incident is closed as a true positive with a determination of phishing.
What to remember for the exam
- Security Copilot is embedded in the Defender portal and offers incident summaries, guided response, script and file analysis, KQL generation and reports.
- Always verify AI output, and remember that it follows the user's permissions.
- Multi stage, multi domain and lateral movement attacks are correlated into one incident.
- The incident graph and blast radius analysis show how entities connect and how far an attacker could reach.
- Case management uses assignment, status, tags, tasks, comments and classification.
A question that asks for a plain language explanation of a script, or a query from a sentence, is pointing to Security Copilot.
How the exam asks about this
- "Turn a natural language question into a hunting query." Security Copilot KQL generation.
- "Visualise the paths an attacker could take from a compromised user to critical assets." Blast radius analysis in the incident graph.
- "Ensure every incident of a type has the same checklist." An automation rule that adds tasks.
- "Record why an incident was closed." Classification and determination.
Common mistakes
Trusting AI output without checking. Verify against the evidence.
Treating each alert separately in a multi stage attack. Work from the incident.
Leaving incidents unassigned. No one owns the work.
Closing without classification. It removes tuning information.
Check yourself
Name two embedded Security Copilot capabilities in the Defender portal.
Incident summary and KQL generation, among others such as guided response and script analysis.
What does blast radius analysis show?
The paths an attacker could take from a compromised entity to critical assets.
Why classify an incident when closing it?
It records the outcome and reason, which supports tuning detections and reporting.
Topic 3 of 5 in Respond to Security Incidents
Test yourself on Respond to Security Incidents
The full Microsoft SC-200 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.