Incident with Copilot

For incidents related to Microsoft Defender XDR and Microsoft Sentinel, the best way to create and share an incident report with Copilot is to use the built-in “Generate incident report” capability in Microsoft Defender, or to prompt Security Copilot directly.

Recommended options:

1. Use Copilot in the Microsoft Defender portal
   1. Open the incident page in Microsoft Defender XDR.
   2. Select the More actions ellipsis (...) and choose Generate incident report, or select the report icon in the Copilot side panel.
   3. Copilot generates the incident report based on data from Microsoft Defender XDR and Microsoft Sentinel, including:
      • Incident creation/closure timestamps and key logs
      • Analysts involved
      • Incident classification and reasons
      • Investigation and remediation actions
      • Follow-up actions and recommendations
   4. When the report card appears in the Copilot pane, use Copy to clipboard, Post to activity log, or Export incident as PDF to share it with stakeholders.
   5. Optionally select Regenerate if an error occurs or if more actions have been taken on the incident.
2. Use the Security Copilot standalone portal
   • In Security Copilot, use a natural language prompt such as:
     • “Generate the incident report for Defender incident {incident ID}.”
   • Include the word Defender in the prompt so Security Copilot uses the Defender XDR plugin and pulls the correct incident data.

Preparation and best practices

To get the most complete incident report when submitting or sharing it:

1. Resolve and classify the incident before generating the report so all actions and outcomes are captured.
2. Add clear, detailed comments to the incident:
   • In Microsoft Defender XDR, use the incident activity log to record analyst notes and decisions.
   • In Microsoft Sentinel, ensure comments are saved in the incident activity log.
3. Use comprehensive language in comments so Copilot can summarize context, reasoning, and next steps accurately.
4. If using ServiceNow with Sentinel, enable the Microsoft Sentinel–ServiceNow bi-directional sync so more robust incident data flows into the report.
5. After generation, copy the incident report back into the incident’s activity log so it is preserved with the incident record.

If additional investigation is needed (for example, suspicious scripts or indicators), start from the incident in Microsoft Defender XDR, use the Copilot button to summarize and analyze artifacts, and then extend the investigation in the Security Copilot standalone experience. Those findings can then be summarized into the incident report.

References:

• Create an incident report with Microsoft Copilot in Microsoft Defender
• Use case: Investigate an incident and associated suspicious entities
• ServiceNow plugin for Microsoft Security Copilot
• Copilot in Teams Chats