Microsoft Copilot for Security in advanced hunting

Applies to:

• Microsoft Defender
• Microsoft Defender XDR

Copilot for Security in advanced hunting

Microsoft Copilot for Security in Microsoft Defender comes with a query assistant capability in advanced hunting.

Threat hunters or security analysts who are not yet familiar with or have yet to learn KQL can make a request or ask a question in natural language (for instance, Get all alerts involving user admin123). Copilot for Security then generates a KQL query that corresponds to the request using the advanced hunting data schema.

This feature reduces the time it takes to write a hunting query from scratch so that threat hunters and security analysts can focus on hunting and investigating threats.

Users with access to Copilot for Security have access to this capability in advanced hunting.

Note

The advanced hunting capability is also available in the Copilot for Security standalone experience through the Microsoft Defender XDR plugin. Know more about preinstalled plugins in Copilot for Security.

Try your first request

1. Open the advanced hunting page from the navigation bar in Microsoft Defender XDR. The Copilot for Security side pane for advanced hunting appears at the right hand side.

   

   You can also reopen Copilot by selecting Copilot at the top of the query editor.

2. In the Copilot prompt bar, ask any threat hunting query that you want to run and press or Enter .

   

3. Copilot generates a KQL query from your text instruction or question. While Copilot is generating, you can cancel the query generation by selecting Stop generating.

   

4. Review the generated query. You can then choose to run the query by selecting Add and run.

   

   The generated query then appears as the last query in the query editor and runs automatically.

   If you need to make further tweaks, select Add to editor.

   

   The generated query appears in the query editor as the last query, where you can edit it before running using the regular Run query above the query editor.

5. You can provide feedback about the generated response by selecting the feedback icon and choosing Confirm, Off-target, or Potentially harmful.

Tip

Providing feedback is an important way to let the Copilot for Security team know how well the query assistant was able to help in generating a useful KQL query. Feel free to articulate what could have made the query better, what adjustments you had to make before running the generated KQL query, or share the KQL query that you eventually used.

Query sessions

You can start your first session anytime by asking a question in the Copilot side pane in advanced hunting. Your session contains the requests you made using your user account. Closing the side pane or refreshing the advanced hunting page does not discard the session. You can still access the generated queries should you need them.

Select the chat bubble icon (New chat) to discard the current session.

Modify settings

Select the ellipses in the Copilot side pane to choose whether or not to automatically add and run the generated query in advanced hunting.

Deselecting the Run generated query automatically setting gives you the option of running the generated query automatically (Add and run) or adding the generated query to the query editor for further modification (Add to editor).