☁️
CTHFM: Azure
  • Welcome
  • Getting Started
    • Account Setup
      • Account Creation Instructions
  • Azure Fundamentals
    • Azure Fundamentals Overview
      • Azure Documentation
      • Azure Entra
      • Azure Hierarchy
      • Identities
      • Azure Entra Roles
      • Azure RBAC
      • Azure Licensing Overview
        • Azure Entra ID Premium Licenses Comparison
      • Azure Shared Responsibility Model
      • Azure Frameworks
      • Azure Security Services
      • Conditional Access Policies
        • How Conditional Access Policies Work
        • Benefits of Conditional Access
        • Best Practices for Conditional Access
        • Conditions for Conditional Access
        • Conditional Access Controls
        • Sign-In Risk and Identity Protection
        • Conditional Access Session Control
        • Name Locations IP Location
      • Azure Quotas
      • Azure Tokens
        • Access Tokens
        • ID Tokens
        • Refresh Tokens
          • Invalidate Refresh Tokens
        • Primary Refresh Tokens
        • Continuous Access Evaluation (CAE)
        • Token Protection: Conditional Access (Public Preview)
  • Azure CLI
    • Introduction to Azure CLI
    • Installing Azure CLI
    • CLI Commands
    • Resource Group Management
    • Creating and Managing Resources with Azure CLI
    • Managing IAM
    • Azure CLI Automation
    • Monitoring and Troubleshooting in Azure CLI
    • Azure CLI Overview
      • Azure CLI: Linux
      • Azure CLI: Windows
      • Azure CLI: MacOS
  • KQL
    • KQL Overview
      • KQL Introduction
      • Data Types
      • Quick Reference
      • Render
      • Basic Queries
  • Powershell
    • PowerShell for Azure
      • Powershell Documentation
      • Powershell Basics
      • Understanding Powershell Variables
      • Understanding Cmdlets
      • Powershell Console & ISE
      • Powershell: Entra Module
        • Module Reference & Getting Started
      • Powershell: Azure Module
        • Installation Instructions
        • Powershell Azure CLI: Windows
        • Powershell Azure CLI: Linux
        • Powershell Azure CLI: MacOS
        • Example Azure Cmdlets
  • Bicep
    • Bicep File Structure
    • Variable Types
  • Azure Logging References
    • Logging
      • Log Retention Strategies
      • Azure Log Types
      • Azure Activity Logs
        • Administrative Event Schema
        • Service Health Notification Schema
        • Resource Health
        • Alert Category
        • Autoscale
        • Security
        • Recommendation
        • Policy
      • Entra ID Logging
        • Identity Based Logs
          • Audit Logs
          • Sign-In Logs
            • AADNonInteractiveUserSignInLogs
            • AADManagedIdentitySignInLogs
            • AADServicePrincipalSignInLogs
            • First Party Sign-In Activity
          • Provisioning Logs (AADProvisioningLogs)
          • Microsoft Graph Activity
          • Identity Protection
            • Risk Detections
            • AADRiskyServicePrincipals
            • AADRiskyUsers
            • AADUserRiskEvents
            • AADServicePrincipalRiskEvents
        • Additional Entra ID Logs
      • Azure Key Vault
        • Azure Key Vault Logging Overview
      • Network Watcher
        • RBAC Permissions
        • Flow Log Types
          • NSG Flow Log Schema
          • VNET Flow Log Schema
        • Enabling Logs
          • NSG Flow Logs
          • VNET Flow Logs
        • Packet Capture
          • Packet Capture: VM
          • Packet Capture: Scale Sets
      • Compute Resources
        • Azure Monitor Agent
        • VM Insights
          • VM Insights Tables
      • Storage Accounts
        • Storage Account Logging
          • File
            • Enable StorageFileLogs
            • StorageFileLogs
          • Blob
            • Enable Blob Logging
            • StorageBlobLogs
          • Queue
            • Enable Queue Logging
            • StorageQueueLogs Table
          • Table
            • Enable Table Logging
            • StorageTableLogs Table
      • Azure App Service
        • Log Types
        • Enabling Logging
      • Azure Monitor
        • Resource Logs
          • Resource Log Top Level Documentation
        • Log Analytics Workspace
          • Setup
        • Workbooks
        • Dashboards
        • Alerts
        • Azure Monitor Documentation
      • Defender for Cloud
      • Intune
      • Sysmon
      • Purview Audit Log Schema
      • Kubernetes Audit Log (AKS)
  • Threat Hunting
    • Threat Hunting in Azure
      • Threat Hunting Introduction
      • Threat Hunting Process
        • Hypothesis Generation
        • Investigation
        • Identification
        • Resolution & Follow Up
      • Pyramid of Pain
      • Azure Threat Hunting Ideas
      • Hands On Threat Hunting Examples
      • OSINT Feeds
  • Sigma
    • Sigma Rule Structure
  • Microsoft Defender TI
    • Microsoft Defender Threat Intelligence
      • Data Sets
      • Reputational Scoring
      • Analyst Insights
      • Microsoft Defender TI: Copilot Integration
  • MITRE Att&ck
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Data Sources
      • MITRE Att&ck Mitigations
      • MITRE Att&ck: Azure
        • MITRE Att&CK: Azure Security Control Mapping
  • Microsoft Resources
    • Microsoft Incident Response Ninja Hub
    • Microsoft Defender XDR Ninja Hub
  • Azure Threat Research Matrix (ATRM)
  • Security Research & Resources
    • Azure Goat
    • Azure Security Research
      • Azure Related CVEs
  • Defender XDR
    • Defender XDR Overview
    • Defender XDR Licensing
    • Defender XDR Default Retention
    • Defender XDR Advanced Hunting Table Schemas
    • Automated Response Requirements
    • Supported Response Actions
  • Azure Sentinel
    • Sentinel Overview
    • Azure Sentinel Deployments
    • Supported Data
    • Workbook, Playbook, Notebook Comparison
    • Sentinel Workbooks
    • Entities
    • User and Entity Behavior Analytics
    • Anomaly Detection
    • Mult-Stage Attack Detection
    • Sentinel: Az CLI
  • Microsoft Defender
    • Microsoft Defender for Cloud References
    • Defender for Cloud: Az CLI
  • Azure Policy
    • Azure Policy
    • Azure Policy Components
    • Azure Policy Rules
    • Scope Azure Policy
    • Policy Assignments
    • Policy Effect
    • Initiative Definition
    • Policy Parameters
    • Remediation Task Structure
    • Use Cases for Azure Policy
    • Azure Policy: Az CLI
  • Intune
    • Intune Overview
    • Intune Licensing
    • Intune API Permission Scopes
    • Intune Sample Script Resources
  • Intune Logging
    • Configure Logging
    • Logging Schema References
    • Intune Queries and Resources
  • Windows Host Security
    • Windows System Architecture and OS Fundamentals
    • SysInternals
    • Basic vs Advanced Security Auditing
    • Sysmon
  • Adversary Emulation
    • AzureHound
    • AADInternals
      • Install
    • RoadTools
      • Install
    • Oh365UserFinder
    • GraphRunner
  • Incident Response
    • Incident Response
      • Azure IR Program Development Cheat Sheet
      • Azure IR Playbooks (MS Guidance)
      • Ransomware (MS Guidance)
  • Automation
    • Automation Overview
    • Logic Apps
      • How Logic Apps Work
      • Logic App Types
      • Triggers
      • Connectors
      • Conditional Logic and Control Flow
      • APIs in Logic Apps
      • Handling Large Workflows with Stateful Logic Apps
      • External Service Integration
      • Securing, Managing, and Scaling Azure Logic Apps
      • Logic Apps: Az CLI
  • Packet Analysis
    • Wireshark Cheatsheet
    • TShark Cheatsheet
    • TCPDUMP Cheatsheet
    • Protocol Analysis Basics
    • HTTP Response Code Cheatsheet
    • RFC Protocol Mappings
    • PCAP Acquisition
  • Detection Lab
    • Detection Lab Introduction
    • Account Creation Instructions
    • Enable MFA Within Azure Tenant
    • Create an Azure Admin With Cloud Shell
    • Setup and Install Instructions
  • VSCode and Code Setup
  • Deploying Code
  • Enabling Logs for Log Analytics Workspace
  • Logging Into Windows VM
  • Verifying Logs in Log Analytics Workspace
  • Creating Detections: Azure Monitor
  • Cost Management: Billing Alarms
Powered by GitBook
On this page
  • Overview:
  • Integration of Microsoft Copilot for Security with Microsoft Defender Threat Intelligence
  • Key Aspects of the Integration
  • Using Copilot for Security with Defender TI: Practical Examples
  1. Microsoft Defender TI
  2. Microsoft Defender Threat Intelligence

Microsoft Defender TI: Copilot Integration

Overview:

This section discusses the integration fo Microsoft Defender TI and Microsoft Copilot. It explains how Copilot can be leveraged to get specific threat intelligence information to defenders.

Integration of Microsoft Copilot for Security with Microsoft Defender Threat Intelligence

Microsoft Copilot for Security is an AI-driven platform designed to assist security professionals by integrating with Microsoft Defender Threat Intelligence (Defender TI). This integration allows Copilot to provide contextual and actionable threat intelligence directly within security workflows, significantly enhancing the capabilities of security teams.

Key Aspects of the Integration

1. Seamless Access to Defender TI Data

Copilot for Security taps into the vast data repository of Defender TI, allowing users to query detailed information about threats, including threat actors, indicators of compromise (IOCs), vulnerabilities, and more. This direct access ensures that the intelligence provided by Copilot is comprehensive, up-to-date, and highly relevant.

For example, a security analyst investigating a suspicious domain could use a prompt like:

  • "Show me threat intelligence data for malicious.com."

Copilot would then pull all relevant information from Defender TI, such as associated IP addresses, WHOIS records, and any known connections to threat actors, giving the analyst a thorough understanding of the domain's potential risks.

2. Contextual Threat Intelligence

The integration enables Copilot to deliver contextual intelligence that helps users understand the broader implications of threats. When investigating an incident, for instance, Copilot can provide data on related threat actors, their known tactics, techniques, and procedures (TTPs), and the infrastructure they typically use.

Consider this prompt example:

  • "Tell me more about Silk Typhoon."

Copilot would retrieve a detailed profile from Defender TI, including the TTPs used by this threat actor, industries they typically target, and known IOCs. This information allows the security team to tailor their defenses specifically to the threat posed by Silk Typhoon.

3. Enrichment of Threat Hunting Flows

Copilot enhances threat hunting by enriching it with data from Defender TI. For example, if a threat hunter needs information about a particular IP address, Copilot can provide details such as reputation scores, historical resolutions, and any associated malicious activity.

A prompt like:

  • "Get resolutions for IP address 192.0.2.1."

will result in Copilot pulling historical DNS data from Defender TI, showing how that IP address has been used over time, which domains it has resolved to, and any associated threat actor infrastructure. This information can be crucial in identifying potential malicious activity and correlating it with ongoing threats.

4. Promptbooks and Pre-Built Prompts

To make accessing Defender TI's rich data easier, Copilot for Security includes promptbooks—collections of predefined prompts that guide users in retrieving specific intelligence. These promptbooks cover various scenarios, such as generating threat actor profiles or assessing the impact of known vulnerabilities.

For instance, using the promptbook, a user might ask:

  • "Generate a vulnerability impact assessment for CVE-2021-44228."

Copilot would then generate a report summarizing the intelligence from Defender TI about this particular vulnerability, including affected technologies, known exploits, and mitigation steps. This feature is especially useful for security teams needing quick, actionable insights without manually sifting through data.

5. Operational Efficiency

The integration allows security teams to utilize Copilot directly within the Microsoft Defender portal, seamlessly incorporating Defender TI's intelligence into their day-to-day operations. This reduces the time and effort required to gather and analyze threat data, allowing teams to respond more quickly and effectively to emerging threats.

For example, a security operations center (SOC) analyst could use a prompt like:

  • "Summarize the latest threats related to my organization."

Copilot would then use Defender TI to gather and summarize relevant threat intelligence, highlighting the most pressing threats based on the organization's exposure. This capability enables the SOC to prioritize incidents that require immediate attention, improving overall security posture.

Using Copilot for Security with Defender TI: Practical Examples

Here are a few practical prompts you can use within Copilot to leverage Defender TI's capabilities:

  • Threat Actor Analysis:

    • "Share the IOCs associated with Silk Typhoon."

    • "What TTPs are linked to the Lazarus Group?"

  • Vulnerability Insights:

    • "Summarize the vulnerability CVE-2021-44228."

    • "Show me threat actors associated with CVE-2021-44228."

  • Infrastructure Intelligence:

    • "Get reputation data for the host example.com."

    • "Show me the latest threat articles related to ransomware."

Last updated 9 months ago