Attack Investigation Agent

Applies to: Project Perception

Important

Some information in this article relates to a prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.

The Attack Investigation Agent is an autonomous tier 2 investigator for security operations teams. Starting from a single alert or incident, the agent correlates signals in Microsoft Defender XDR to reconstruct the attack story, scope, and impact.

You can start an investigation with or without prior triage by an analyst or the Security Alert Triage Agent. This article describes the agent's capabilities and prerequisites. It also explains how to set up the agent, run and monitor a session, and review the results.

Key capabilities

The Attack Investigation Agent runs a multi-step, AI-orchestrated investigation that:

Reconstructs the full attack story: Explains who attacked, how they gained access, which resources they affected, and the scope and impact of the attack. The agent goes beyond individual alerts.
Provides clear, actionable answers: Explains the attack scope, initial access, progression, technical impact, investigation status, and classification.
Investigates a broad range of attacks: Investigates attacks involving users, devices, cloud apps, containers, and other entities without relying on a predefined scenario.
Supports interactive investigation: Lets analysts chat with the agent throughout the investigation to ask questions or request deeper analysis.
Adapts to your environment: Uses multiple data sources and follows your organization's policies and practices.

Prerequisites

Required licenses and products

You need all the following products to use the Attack Investigation Agent:

Microsoft 365 E5
Microsoft Defender XDR
Microsoft Security Copilot

Your organization must also be onboarded to the Microsoft Defender data lake and unified security experience.

For broader investigation coverage, the recommended products depend on the attack type:

For cloud and container attacks:
- Microsoft Defender for Cloud
- Microsoft Defender for Containers
For identity attacks:
- Microsoft Entra ID P2
- Microsoft Defender for Identity
- Microsoft Defender for Cloud Apps

Additional permissions required

Users who start an investigation also need the following permissions in Microsoft Defender XDR unified role-based access control (RBAC):

Security data basics (read) for all workloads
Alerts (manage)
Security Copilot (read)
Email & collaboration metadata (read)
Email & collaboration content (read)

Recommended Defender configuration

To investigate user-reported phishing alerts, configure the following settings:

Activate the Microsoft Defender for Office 365 workload in unified RBAC settings.
Enable Monitor reported messages in Outlook, and select a destination for reported messages. For more information, see Configure user reported settings.
Enable the Email reported by user as malware or phish alert policy. For more information, see Alert policies in Microsoft Defender XDR.
Disable the built-in Auto-Resolve - Email reported by user as malware or phish alert tuning rule and any custom tuning rules that resolve this alert. For more information, see Tune an alert.
If you use a third-party reporting tool, configure the tool so reported messages reach Microsoft Defender. For more information, see Options for third-party reporting tools.

Set up the agent

To set up this agent, follow the steps in Set up an agent.

Start a session

For ways to start a session, see Start a new session.

This agent runs through the following playbook:

Playbook	Required input
Investigate Incident	The ID of a single alert or incident from the Microsoft Defender portal.

Note

You can also start this agent directly from an alert or incident detail page in the Defender portal. For more information, see Run playbooks from incidents and threat intelligence.

Monitor session progress

While the session runs, the session detail panel shows:

Summary: Current session status and completed work.
Progress: Completed investigation steps.
Agents: The agent assigned to the session.
Inputs: The alert or incident ID you provided.
Artifacts: Output files generated during the investigation.

Session status values

Status	Description
In progress	The agent is actively working.
Completed	The session finished successfully, and all output is available.
Completed with failures	The session finished with one or more problems. Review the session details for more information.

Review the output

The Attack Investigation Agent produces an investigation report with the following sections:

Executive summary: An overview of the attack for stakeholders and escalation.
Incident verdict: Classification as true positive, false positive, or benign with transparent reasoning.
Attack timeline: A chronological sequence of key events showing the progression of the attack from initial access through post-compromise activity.
Affected entities: Identified users, devices, and applications affected by the attack.
MITRE ATT&CK techniques observed: Mapping of observed attacker behavior to MITRE ATT&CK techniques with evidence for each technique.
Indicators of compromise: Extracted and enriched indicators of compromise (IOCs), including IP addresses, domains, file hashes, URLs, and email addresses with threat intelligence context.
Recommended next steps: Prioritized actions for containment, remediation, and prevention.

The report appears as a Markdown file in the Artifacts section of the session details. You can download the report to add to incident documentation or compliance records.