Microsoft Sentinel incident investigation using Copilot for Security

[pratik-lal]

This is a Logic App that automates incident investigation within Microsoft Sentinel using the Microsoft Copilot for Security prompt and built-in skills. It is designed to:

1. Read Microsoft Sentinel incident entities.
2. Process and normalize the entities.
3. Submit prompts to Copilot for Security to analyze each entity type.
4. Summarize the outputs in a predefined format.
5. Update the Microsoft Sentinel incident comments for the incident investigator to review.

By leveraging this Logic App, Security Operations Center (SOC) and incident response teams can significantly reduce investigation time, gain consistent analysis outputs, and enhance their incident response process.

[pratik-lal]

@microsoft-github-policy-service agree company="Microsoft"