Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Important
Some information in this article relates to a prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
Each agent in Project Perception belongs to one of the following categories, identified by color: red team, blue team, or green team. The category reflects the agent's role in a coordinated defense system. Red team agents find and expose gaps. Blue team agents detect, triage, and investigate. Green team agents remediate and harden your posture. Together, they form a multi-agent defense that responds continuously to threats.
Red team agents
Red team agents simulate attacker behavior to expose vulnerabilities before adversaries can exploit them. They map your environment, identify attack paths, and surface gaps in your defenses so you can act before a real attack occurs.
| Agent | What it does |
|---|---|
| Recon Agent | Performs attacker scouting activities to map your environment, surface attack paths, choke points, valuable assets, configuration issues, and excess permissions. |
Blue team agents
Blue team agents detect, triage, and investigate threats. They operationalize threat intelligence, close coverage gaps, triage alerts, reconstruct attack stories, and author new detections to keep your defenses current.
| Agent | What it does |
|---|---|
| Triage Agent | Classifies and resolves alerts as true or false positives, with detailed explanations behind its conclusions. It learns from context and feedback to improve accuracy over time. |
| Threat Intelligence Agent | Extracts attack patterns, indicators, and key threat intelligence objects, then analyzes them to identify how to defend against or respond to a threat. |
| Attack Investigation Agent | Reconstructs the full attack story by correlating alerts, incidents, and security signals. It provides analyst-ready insights, including verdicts, timelines, techniques, indicators of compromise, and affected entities. |
| Detection Authoring Agent | Identifies gaps in threat coverage and creates detection rules to improve defenses as threats evolve. |
Green team agents
Green team agents remediate and harden your security posture. They evaluate exposure, prioritize fixes by real-world risk, and surface the actions that reduce risk most effectively.
| Agent | What it does |
|---|---|
| Posture Prioritization Agent | Ranks posture issues by real-world risk, exposure, exploitability, and asset criticality. It provides focused guidance on what to fix first and why. |
How agent categories work together
These categories are designed to work as a coordinated system, not as independent tools. A typical workflow moves through all of them:
- Blue team agents gather intelligence. The Threat Intelligence Agent analyzes campaigns and threat actors relevant to your environment.
- Red team agents map the exposure. The Recon Agent simulates attacker movement, mapping attack paths against what blue team intelligence surfaced.
- Green team agents prioritize remediation. The Posture Prioritization Agent evaluates exploitability and surfaces the highest-value fixes.
- Blue team agents close coverage gaps. The Detection Authoring Agent creates detections for newly discovered techniques, and the Attack Investigation Agent investigates any incidents that surfaced during the workflow.
Throughout this process, agents pause and request your approval before taking high-impact actions. You review, approve, or reject each proposed action before the agent proceeds.