Mitigate threats using Microsoft Security Copilot: Review

This entire five-hour path feels like it could have been a 30-minute marketing video. The whole thing is built around these “guided simulations,” which are just sandboxed, click-this-then-that tours of the Security Copilot UI. You can’t deviate. You can’t input your own prompts or chase a different lead. It’s a choose-your-own-adventure where all paths lead to the pre-approved Microsoft answer.

I get the point. It shows how Copilot is meant to stitch together alerts from Sentinel and Defender XDR. Visually, it connects the dots. But it doesn't teach you the *thinking* behind it. The prompts are fed to you. The 'investigation' is a foregone conclusion. There's no room for error, which also means there's no room for actual learning.

I was hoping for some substance on how to write effective prompts for incident response, or maybe a look at the API, or how this thing actually interfaces with the underlying products. Instead, I got module after module describing what a large language model is, followed by glorified screenshots. The final simulation on a password spray attack felt particularly sterile. It’s like learning to be a chef by watching someone else follow a recipe on TV.

If your boss is asking what this new AI thing is, this path will give you the vocabulary to answer them. But if you're a security analyst looking to actually use the tool to mitigate a real threat, this isn't it.