Trace how playbooks connect stages of work
Triggering a playbook launches several coordinated stages of work with a single click. Understanding what actually happens inside that click is the difference between trusting the output and treating it like a black box.
A playbook walkthrough: Protect against a threat
A coordinated agent playbook takes a security objective and orchestrates the sequence of work needed to close that objective. The harness passes context and findings from one stage to the next, and each stage runs on the agent built for that kind of work.
The Protect against a threat playbook is the canonical example. When a threat actor advisory arrives, a SOC engineer starts the playbook from Perception, and it runs four stages as one connected workflow:
- Threat intelligence analysis. The Threat Intelligence Agent (Blue) extracts the actor's tactics, techniques, and indicators.
- Attack path analysis. The Recon Agent (Red) reads that intelligence and maps whether the environment presents the paths the actor exploits.
- Posture prioritization. The Posture Prioritization Agent (Green) ranks the resulting findings by real-world risk and recommends remediation order.
- Detection engineering. The Detection Authoring Agent (Blue) writes new rules to close coverage gaps identified along the way.
At each stage, the agent for the next stage reads what the previous one produced through security context, without a ticket in between. That's what "coordinated" means in practice.
Protect against a threat is the canonical playbook that coordinates across several areas of work. Project Perception also ships playbooks focused on one area of work that dig into it deeply. Both patterns use the same primitives: a specialized agent handling each stage, shared context, and approval gates. The difference is how many areas of work each playbook covers.
The following table shows the two coordination patterns across Project Perception's preview playbook catalog. Each focused playbook concentrates on one area of work you saw in the previous unit.
| Pattern | Example playbooks |
|---|---|
| Coordinated across several areas of work | Protect against a threat (four stages, walked through above) |
| Focused on one area of work | - Extract threat intelligence (threat intelligence analysis) - Investigate incident (incident investigation) - Identify attack paths (attack path analysis) - Assess identity risks (attack path analysis, identity-focused) |
How humans stay in control
Project Perception's agents each specialize in a defined area of work rather than one super-agent doing everything, and each agent operates under a least-privilege identity scoped to the minimum permissions its task requires. Attack path analysis needs different access than posture prioritization, and posture prioritization needs different access than alert triage. Agents run at machine speed. Humans stay in control through safeguards built into the workflow rather than a separate governance module:
- Approval gates. Pause the workflow before high-impact actions.
- Least-privilege agent identity. Each agent runs under its own dedicated Microsoft Entra Agent ID identity with access scoped to what it's built to do, so agent activity is attributable to that agent and not to a human.
- URBAC prerequisite. As covered in the module prerequisites, unified role-based access control (URBAC) across Microsoft Defender workloads is currently required before Perception can be used.
- Audit logging. Every agent action is logged.
Project Perception inherits the identity, permission, and audit controls already in use in the Defender portal rather than introducing a parallel governance model.
Where this leaves you
Playbooks connect specific stages, with specialized agents handling each stage and humans retaining control over critical decisions.
Tip
Before you move on: Which four stages did the Protect against a threat playbook coordinate, and in what order? If the sequence isn't clear, revisit the numbered list and the diagram.
With the playbook mechanics on paper, the next question is how to recognize which situations call for a coordinated playbook in the first place.