Freigeben über

Get Agents in Microsoft Security Store

Follow these steps to discover and deploy modular agents that automate tasks like triage, remediation, and enrichment across Microsoft Security products.

  1. Navigate to the Security Store portal.

  2. Select Explore agents from the Security agents card on Security Store portal.

  3. Search for agents by typing your search query and/or filter agents by Microsoft Security products or Publisher or other filters.

  4. Select an agent to view details.

  5. View the agent details page for information on what the agent does, inputs it needs, and its requirements. Select Get solution. This starts the agent purchase and deployment flow.

  6. Select the Azure billing subscription with resource group and name for the agent purchase information. To purchase/deploy the agent, you need to have a contributor or owner role on the Azure subscription. See Roles and permissions for more details on the roles required to purchase and deploy offers.

  7. Select Next to view the agent's deployment resource information. If the agent has Microsoft Sentinel data lake resources, you can select the Sentinel workspace.

  8. Select Next to review the order and deployment details. You can view the publisher's Terms of use and Privacy policy.

  9. Select Place order to start the purchase and deployment process.

  10. This process creates billing resources and resources needed to run the agent, including the agent instance in Copilot, applicable Sentinel data lake notebook jobs, and Azure resources. Once it completes, select Open Microsoft Security Copilot to be directed to Security Copilot to configure and work with this agent.

    Note

    Setting up the agent requires a Security Copilot owner or contributor role and potentially an Entra global admin to grant the agent permissions.

    Screenshot of the assignment insights security store page showing the need for permission from a Global Administrator to permit your org to set up this agent.

  11. If you choose to work with this agent later, you can go to Management > My solutions, find your deployed agent, and select View details.

    • You can work with the agent in Security Copilot by selecting Open Microsoft Security Copilot.

    • You can also go to any Sentinel data lake notebook jobs by selecting Manage in Defender.

    Screenshot of the portal's agent details page with information on what the agent does, inputs it needs, and requirements.

Related content

What is Security Store?

Use Microsoft Security Store to find, buy, and deploy security solutions and agents

  • Last updated on