SOC Daily Brief Agent

For the interactive Chat with agent experience, the user may provide a natural language request related to the daily brief, such as asking for more details about high-priority incidents, detection drivers, SecOps Efficiency metrics, MITRE tactics, tuning candidates, audit notes, or a concise operational summary.

Task

The agent collects and correlates connected security operations data from the configured Sentinel workspace and Defender XDR evidence when available. It uses structured queries and agent orchestration to summarize incident lifecycle activity, severity and status distribution, alert and detection drivers, recurring entities, high-priority incidents, queue and backlog indicators, automation health, closure classifications, product trends, and MITRE ATT&CK-oriented activity.

The agent calculates or reports Security Operations Efficiency metrics such as Mean Time to Triage, Mean Time to Closure, incidents by closing classification, incidents created by product over time, and incidents created by MITRE tactic over time. If the required data is unavailable, the agent explicitly states the limitation instead of estimating or fabricating metrics.

The agent is read-only. It does not close incidents, assign owners, isolate devices, disable users, modify analytics rules, run remediation actions, or execute playbooks.

Outputs

The agent produces a structured daily SOC leadership briefing that may include:

• Executive Summary
• SOC Leadership Decision Snapshot
• Service Value and Operational Evidence Highlights
• Security Operations Efficiency
• Mean Time to Triage and Mean Time to Closure
• Incidents by closing classification
• Incidents created by product over time
• Incidents created by MITRE ATT&CK tactic over time
• Incident Lifecycle and Queue Health
• Incident and Alert Overview
• Detection Drivers
• MITRE ATT&CK and Detection Trends
• Recurring Entities and Repeated Patterns
• High-Priority Items Requiring Attention
• Automation and Workflow Health
• Recommended SOC Lead Actions
• Audit, Evidence, and Data Quality Notes

The Chat with agent experience allows users to ask follow-up questions about the daily brief, request explanations of findings, review tuning candidates, clarify operational metrics, prepare audit notes, or generate concise summaries for SOC handovers and leadership discussions.

Required products and permissions

The customer requires Microsoft Security Copilot with available SCU capacity, Microsoft Sentinel with a connected Log Analytics workspace, and Microsoft Defender XDR evidence where available. Recommended least-privilege access includes Security Copilot workspace access, read access to relevant Defender XDR data, and Microsoft Sentinel Reader access to the configured workspace. Global Administrator is not required.

Estimated SCU consumption

Initial measured consumption in the pilot environment was approximately 0.4 SCU per full scheduled or manual agent execution and approximately 0.1 SCU per Chat with agent interaction. Actual consumption may vary depending on workspace size, incident volume, available telemetry, data source availability, and the complexity of chat follow-up questions.

As a planning baseline, a business-day model with 22 runs per month is estimated at approximately 8.8 SCU per month, excluding chat interactions. A daily model with 30 runs per month is estimated at approximately 12.0 SCU per month, excluding chat interactions. Chat usage should be estimated separately based on expected user interaction volume.

---------

Version history / change log

0.1.0 - Initial marketplace release. Includes daily 24-hour SOC leadership briefing, manual and scheduled execution support, Chat with agent follow-up, connected workspace incident and alert summarization, Security Operations Efficiency metrics, MITRE ATT&CK-oriented trends, automation health, high-priority item review, recommended SOC Lead actions, and audit/data quality notes.