Skip to content

Commit

Permalink
Rebranding Security Copilot updates (Draft)
Browse files Browse the repository at this point in the history
[NOT READY FOR REVIEW YET][PART 02] The updates here are made as per task https://office.visualstudio.com/MAX/_workitems/edit/9373967/.
  • Loading branch information
alekyaj committed Oct 16, 2024
1 parent 68ad53a commit 9dbefe9
Showing 1 changed file with 35 additions and 35 deletions.
70 changes: 35 additions & 35 deletions memdocs/intune/copilot/security-copilot.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
---
# required metadata

title: Use Copilot for Security to get device and policy information
description: You can use Copilot for Security to get information about your Intune data, including devices, apps, policies, and groups managed in Intune. You can also compare policies, get device specific details, and get target info for policies.
title: Use Security Copilot to get device and policy information
description: You can use Security Copilot to get information about your Intune data, including devices, apps, policies, and groups managed in Intune. You can also compare policies, get device specific details, and get target info for policies.
keywords:
author: MandiOhlinger
ms.author: mandia
Expand Down Expand Up @@ -32,73 +32,73 @@ ms.collection:
- magic-ai-copilot
---

# Access your Microsoft Intune data in Copilot for Security
# Access your Microsoft Intune data in Security Copilot

Copilot for Security is a cloud-based AI platform that provides a natural language Copilot experience. It can help support security professionals in different scenarios, like incident response, threat hunting, and intelligence gathering. For more information about what it can do, go to [What is Microsoft Copilot for Security?](/security-copilot/microsoft-security-copilot).
Security Copilot is a cloud-based AI platform that provides a natural language Copilot experience. It can help support security professionals in different scenarios, like incident response, threat hunting, and intelligence gathering. For more information about what it can do, go to [What is Microsoft Security Copilot?](/security-copilot/microsoft-security-copilot).

**Copilot for Security integrates with your Microsoft Intune data**.
**Security Copilot integrates with your Microsoft Intune data**.

If you use [Microsoft Intune](../fundamentals/what-is-intune.md) in the same tenant as Copilot for Security, then you can use Copilot for Security to get insights about your Intune data.
If you use [Microsoft Intune](../fundamentals/what-is-intune.md) in the same tenant as Security Copilot, then you can use Security Copilot to get insights about your Intune data.

There are Intune capabilities built into Copilot for Security, and you can use prompts to get more information, including:
There are Intune capabilities built into Security Copilot, and you can use prompts to get more information, including:

- Information about your devices, apps, compliance & configuration policies, and policy assignments managed in Intune
- Managed device attributes and hardware details
- Issue with specific devices and compare a working & non-working device

This article shows you how to access your Microsoft Intune data in Copilot for Security and includes sample prompts.
This article shows you how to access your Microsoft Intune data in Security Copilot and includes sample prompts.

## Security admin focus

Copilot for Security has a Security Operations Center (SOC) or security admin focus. So, if you're a SOC analyst or security admin, then you can use Copilot for Security to get the security posture of devices that Intune manages.
Security Copilot has a Security Operations Center (SOC) or security admin focus. So, if you're a SOC analyst or security admin, then you can use Security Copilot to get the security posture of devices that Intune manages.

For example, there's a user or device that is showing signs of malicious intent. Also, you notice some events are happening after the malicious intent, like an unknown device enrolling in Intune. Maybe someone is trying to use stolen credentials to enroll and get access. You need to get more information.

In Copilot for Security, you can use the Intune capabilities to get more information, like:
In Security Copilot, you can use the Intune capabilities to get more information, like:

- Ask about a specific device, get all the properties about that device, including the device name, device ID, and device manufacturer.
- Determine when the device is enrolled in Intune.
- Find the primary user of a device
- Determine the type of device, like a laptop or mobile phone.
- Check the compliance status, especially if a device is noncompliant, and why it's noncompliant.

In Microsoft Defender, you can use this information, including the device type, to determine your next steps. For example, you might take different actions based on the type of device (laptop vs. mobile phone vs. tablet). Copilot for Security can also give you a link to the device in Microsoft Defender, so you can run any Defender actions.
In Microsoft Defender, you can use this information, including the device type, to determine your next steps. For example, you might take different actions based on the type of device (laptop vs. mobile phone vs. tablet). Security Copilot can also give you a link to the device in Microsoft Defender, so you can run any Defender actions.

### What you need to know

- When an admin submits a prompt, Copilot can only access the data that the admin has permissions to, which includes the [RBAC roles](../fundamentals/role-based-access-control.md) and [Intune scope tags](../fundamentals/scope-tags.md) assigned to them.

If you want your admins to access all your Intune data in Copilot for Security, then use the following role in Microsoft Entra ID:
If you want your admins to access all your Intune data in Security Copilot, then use the following role in Microsoft Entra ID:

- Intune Service Administrator (also known as Intune Administrator)

For more information on roles and authentication, go to:

- [Roles and authentication in Microsoft Copilot for Security](/security-copilot/authentication)
- [Roles and authentication in Microsoft Security Copilot](/security-copilot/authentication)
- [Role based access control (RBAC) in Intune](../fundamentals/role-based-access-control.md)
- [Use RBAC and scope tags for distributed IT in Intune](../fundamentals/scope-tags.md)

- You can access your Intune data in the [Copilot for Security portal](https://go.microsoft.com/fwlink/?linkid=2247989) and Copilot in the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). For more information on Copilot in Intune vs. Copilot for Security, and other common questions, go to the [Microsoft Copilot in Intune FAQ](copilot-intune-faq.md).
- You can access your Intune data in the [Security Copilot portal](https://go.microsoft.com/fwlink/?linkid=2247989) and Copilot in the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). For more information on Copilot in Intune vs. Security Copilot, and other common questions, go to the [Microsoft Copilot in Intune FAQ](copilot-intune-faq.md).

## Open Copilot for Security and enable Intune
## Open Security Copilot and enable Intune

To use the Intune capabilities in Copilot for Security, enable the Intune plugin.
To use the Intune capabilities in Security Copilot, enable the Intune plugin.

1. Go to [Microsoft Copilot for Security](https://go.microsoft.com/fwlink/?linkid=2247989) and sign in with your credentials.
1. Go to [Microsoft Security Copilot](https://go.microsoft.com/fwlink/?linkid=2247989) and sign in with your credentials.
2. In the prompt bar, select **Sources** (right corner).

:::image type="content" source="./media/security-copilot/security-copilot-sources.png" alt-text="Screenshot that shows the plugin sources that are available, enabled, and disabled in Microsoft Copilot for Security.":::
:::image type="content" source="./media/security-copilot/security-copilot-sources.png" alt-text="Screenshot that shows the plugin sources that are available, enabled, and disabled in Microsoft Security Copilot.":::

3. In **Manage sources**, turn on Microsoft Intune:

:::image type="content" source="./media/security-copilot/intune-plug-in-enabled.png" alt-text="Screenshot that shows the Microsoft Intune plug-in source is enabled in Microsoft Copilot for Security.":::
:::image type="content" source="./media/security-copilot/intune-plug-in-enabled.png" alt-text="Screenshot that shows the Microsoft Intune plug-in source is enabled in Microsoft Security Copilot.":::

> [!NOTE]
> Some roles can enable or disable plugins. For more information, go to [Manage plugins in Microsoft Copilot for Security](/security-copilot/manage-plugins).
> Some roles can enable or disable plugins. For more information, go to [Manage plugins in Microsoft Security Copilot](/security-copilot/manage-plugins).
## Use the built-in features

In Copilot for Security, there are built in system features that are helpful for Intune admins. For a walkthrough of Copilot for Security, go to [Navigating Microsoft Copilot for Security](/security-copilot/navigating-security-copilot).
In Security Copilot, there are built in system features that are helpful for Intune admins. For a walkthrough of Security Copilot, go to [Navigating Microsoft Security Copilot](/security-copilot/navigating-security-copilot).

This section describes some of the features that are helpful for Intune admins.

Expand All @@ -108,27 +108,27 @@ Capabilities are built-in features that can get data from the different plugins

To view the list of Intune built-in system capabilities for Intune, use the following steps:

1. In the [Copilot for Security portal](https://go.microsoft.com/fwlink/?linkid=2247989) prompt bar, select the Copilot prompts icon > **See all system capabilities**.
1. In the [Security Copilot portal](https://go.microsoft.com/fwlink/?linkid=2247989) prompt bar, select the Copilot prompts icon > **See all system capabilities**.

:::image type="content" source="./media/security-copilot/security-copilot-system-capabilities.png" alt-text="Screenshot that shows how to select the prompts icon and system capabilities in Microsoft Copilot for Security.":::
:::image type="content" source="./media/security-copilot/security-copilot-system-capabilities.png" alt-text="Screenshot that shows how to select the prompts icon and system capabilities in Microsoft Security Copilot.":::

2. In the Microsoft Intune section, there's a list of all the built-in capabilities for Intune. You can select any of the capabilities and get more information about that capability.

### Sessions

When you use prompts in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) or in the Copilot for Security portal, the sessions are saved. To see the saved sessions, use the following steps:
When you use prompts in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) or in the Security Copilot portal, the sessions are saved. To see the saved sessions, use the following steps:

1. In the [Copilot for Security portal](https://go.microsoft.com/fwlink/?linkid=2247989), go to the menu > **My sessions**.
1. In the [Security Copilot portal](https://go.microsoft.com/fwlink/?linkid=2247989), go to the menu > **My sessions**.

:::image type="content" source="./media/security-copilot/security-copilot-menu-my-sessions.png" alt-text="Screenshot that shows the Microsoft Copilot for Security menu and My sessions with previous sessions in Copilot for Security portal.":::
:::image type="content" source="./media/security-copilot/security-copilot-menu-my-sessions.png" alt-text="Screenshot that shows the Microsoft Security Copilot menu and My sessions with previous sessions in Security Copilot portal.":::

2. When you select a session, your previous prompts and results are shown. Every session also has a session ID in the URL. You can share this session ID with others to review the same prompt session.

For example, your session ID is something like `https://securitycopilot.microsoft.com/sessions/023d1c61-f3c7-4702-8924-075a1058900d`.

## Sample prompts for Intune

You can create your own prompts in Copilot for Security to get information about your Intune data. This section lists some ideas and examples.
You can create your own prompts in Security Copilot to get information about your Intune data. This section lists some ideas and examples.

### Before you begin

Expand All @@ -143,8 +143,8 @@ You can create your own prompts in Copilot for Security to get information about

You can also save your prompts in a promptbook for future use. For more information, go to:

- [Prompting in Microsoft Copilot for Security](/security-copilot/prompting-security-copilot)
- [Using promptbooks in Microsoft Copilot for Security](/security-copilot/using-promptbooks)
- [Prompting in Microsoft Security Copilot](/security-copilot/prompting-security-copilot)
- [Using promptbooks in Microsoft Security Copilot](/security-copilot/using-promptbooks)

### General information about your Intune data

Expand Down Expand Up @@ -196,22 +196,22 @@ Get the **similarities and differences** between two devices, like the complianc

## Provide feedback

Your feedback on the Intune integration with Copilot for Security helps with development. To provide feedback, in Copilot for Security, use the feedback buttons at the bottom of each completed prompt.
Your feedback on the Intune integration with Security Copilot helps with development. To provide feedback, in Security Copilot, use the feedback buttons at the bottom of each completed prompt.

:::image type="content" source="./media/security-copilot/security-copilot-prompt-feedback.png" alt-text="Screenshot that shows how to submit feedback on the prompt results in Microsoft Copilot for Security.":::
:::image type="content" source="./media/security-copilot/security-copilot-prompt-feedback.png" alt-text="Screenshot that shows how to submit feedback on the prompt results in Microsoft Security Copilot.":::

Whenever possible, and when the result isn't what you expect, write a few words explaining what can be done to improve the outcome. If you entered Intune-specific prompts and the results aren't Intune related, then include that information.

## Data processing and privacy

For more information about data privacy in Copilot for Security, go to [Privacy and data security in Microsoft Copilot for Security](/security-copilot/privacy-data-security).
For more information about data privacy in Security Copilot, go to [Privacy and data security in Microsoft Security Copilot](/security-copilot/privacy-data-security).

When you interact with the Security Copilot to get Intune data, the Security Copilot pulls that data from Intune. The prompts, the Intune data that's retrieved, and the output shown in the prompt results is processed and stored within the Security Copilot service.

When you use Copilot for Security to get Intune data, Copilot for Security also has access to the data and permissions defined by the [RBAC roles](../fundamentals/role-based-access-control.md) and [Intune scope tags](../fundamentals/scope-tags.md) assigned to you.
When you use Security Copilot to get Intune data, Security Copilot also has access to the data and permissions defined by the [RBAC roles](../fundamentals/role-based-access-control.md) and [Intune scope tags](../fundamentals/scope-tags.md) assigned to you.

## Related articles

- [What is Microsoft Copilot for Security?](/security-copilot/microsoft-security-copilot)
- [Privacy and data security in Microsoft Copilot for Security](/security-copilot/privacy-data-security)
- [What is Microsoft Security Copilot?](/security-copilot/microsoft-security-copilot)
- [Privacy and data security in Microsoft Security Copilot](/security-copilot/privacy-data-security)
- [Use Microsoft Copilot in Intune](copilot-intune-overview.md)

0 comments on commit 9dbefe9

Please sign in to comment.