Navigate Security Copilot

The Security Copilot platform has navigational features to maximize its functionality. As you explore the system, reference this article for more details.

Understand the landing experience

When you open Security Copilot, your experience might differ depending on your onboarding and rollout stage.

• Agents-first experience (new) – Agents are the default homepage, with guided actions to help you get started.
• Chat-first experience (existing) – Chat and prompts are available directly on the homepage.

Agents-first experience

In the agents-first experience, the Agents area is the primary entry point when you open Security Copilot. From here, you can browse available agents, view agents that are already active in your workspace, and access setup options.

Note

The agents-first homepage doesn't include the general chat prompt bar. To start a general chat session, go to All history and select New session.

Chat-first experience

In the chat-first experience, the homepage opens directly to the chat prompt bar where you can start typing prompts immediately. The Agents area is accessible from the home menu but is not the default view.

Explore

Need some ideas on what to explore next? The key landmarks differ depending on your landing experience.

Agents-first landmarks

In the agents-first experience, navigation centers on the Agents area and the home menu.

For more information on finding and using agents, see Discover agents.

Chat-first landmarks

In the chat-first experience, the following key landmarks are on the homepage:

1. Home menu
2. Prompts
3. Sources
4. Help

Once you start your first prompt, more features light up:

1. Process log to see what Security Copilot is up to.
2. Create a promptbook based on the selected prompts.
3. Share your session with your team.
4. Side panel where the Pin board displays.
5. Pin a prompt to the pin board.

Home menu

The home menu provides access to key areas of Security Copilot. The options available are the same in both experiences, but the default view on the homepage differs.

• Home gets you back to the initial page.

• Agents – In the agents-first experience, this is the default homepage. In the chat-first experience, select Agents from the home menu to access the agent library. Browse the agent library, view agents active in your workspace, and, depending on your role, set up and manage agents. For more information, see Discover agents and Setup and manage agents.

• Promptbooks - For more information, see Using promptbooks.

• Build - For more information, see Build custom agents.

• All history - Provides access to your session history and allows you to create a new session.

• Owner - This menu is available only if you have the Security Copilot Owner role.

  • Owner settings - For more information, see Configure owner settings.
  • Plugin settings - For more information, see Manage plugin restrictions.
  • Role assignment - For more information, see Assign roles.
  • Usage monitoring - For more information, see Monitor security compute units use.

• Settings - Includes access to set the theme, time zone, and language preferences.

• Tenant switching - Allows you to switch between tenants. Requires specific authentication.

  

  When a user signs into the Security Copilot platform for their tenant, but the security-related data is in a different tenant, you must explicitly switch to that tenant.

  With the tenant switch feature, the external member or guest account configured with the appropriate role in the tenant, is authorized to conduct sessions using data in that tenant.

  The Security Copilot portal reloads and initially shows the tenant ID in the URL like this:

  https://securitycopilot.microsoft.com/?tenantId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

  Tip

  Manually modifying the tenant ID portion of the Security Copilot URL will also switch the tenant.

For more information, see the following articles:

• Understand authentication
• Grant MSSP access

Access chat and sessions

Note

If you have the agents-first experience, the homepage doesn't include the general chat prompt bar — use the steps below to start a general chat session. If you have the chat-first experience, the prompt bar is available directly on the homepage. You can also use All history to resume a previous session or start a new one.

To start a chat session:

1. Select All history.
2. Review your previous sessions.
3. Select New session.

You can continue previous sessions or start a new one from this view.

Prompts

Check out these great articles to use promptbooks, find prompts to start with, and create great prompts on your own.

Note

In some experiences, prompts are accessed through a chat session instead of directly from the homepage.

• Try promptbooks
• Prompting in Security Copilot
• Create effective prompts

Manage sources

Manage plugin enablement and file sources.

For more information, see the following articles:

• Manage plugins
• File uploads

Get help

Access the support link and documentation articles from the Get help menu.

For more information on these options, see the following articles:

• Documentation
• Training
• Support - Contact support

Prompt features

Here are the features available once you create your prompt.

Process log

The process log appears directly under your prompt after you send it. As the response is being formed, notice the plugin chosen.

Each plugin and its capabilities directly correspond to prompts found when selecting See all system capabilities.

For example, in the process log shown, the Microsoft Defender XDR plugin is chosen. Also the prompt icon proceeds the prompt Generate guided response, which indicates this prompt was a specific capability of the plugin.

When you select the Prompts button, use the search to find capabilities. Select See all system capabilities to see all the prompts listed for each plugin.

Note

The Generate guided response session is just one of the possible sessions created by the Defender XDR embedded experience. When you interact with an embedded Copilot experience to produce results, the session will appear in your session list.

Many responses include direct links to data provided by the Microsoft service plugin chosen by the response. Use the direct links and the process log to build trust in Security Copilot while you verify it's delivering accurate, appropriate responses.

Pin important items to the session

Use the pin board to keep track of important responses in your session. When a response is pinned for the first time, Security Copilot generates a summary of the session for the pin board.

Pin multiple prompt-response pairs to expand what is included in the summary. Pinned items show a condensed response that is expandable. The last prompt pinned is ordered last in the pin board. If you pin a prompt from the middle of the session last, that's where it's pinned on the pin board.

Along with the summary, the pin board features tags under the session name to help provide context to the session.

Share a session

At any time during a Security Copilot session, share your work with your team or decision makers. Select to create a link.

The send via email option isn't available in these regions. Use the Copy link and send manually for the following regions:

• SouthAfricaNorth
• UAENorth

Tip

Keep in mind, this link references the entire session, not just the portion conducted prior to selecting the Share feature.

The same Share feature is available while reviewing My sessions.

Warning

When the link is shared by the owner to anyone with Security Copilot access in the same tenant, they are able to view the shared session. Shared sessions show a static display of the entire session, whether they normally have access to the underlying security data or not.

While accessing a shared session, there's an option to Export the results.

View the shared session summary and pinned items to quickly understand the shared content. For more information, see Shared session access.

Create a promptbook

For more information, see Build your own promptbook