A security operations team is using Microsoft Security Copilot to investigate a suspected phishing campaign. The analyst wants Security Copilot to automatically retrieve related indicators from Microsoft Defender Threat Intelligence. Which Security Copilot capability enables this integration?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because Security Copilot uses Plugins to connect to external and Microsoft data sources including Microsoft Defender Threat Intelligence, Microsoft Sentinel, Defender XDR, and third-party tools. Plugins extend Copilot's capabilities to pull live threat intelligence data.
Full explanation below image
Full Explanation
C is correct because Security Copilot uses Plugins to connect to external and Microsoft data sources including Microsoft Defender Threat Intelligence, Microsoft Sentinel, Defender XDR, and third-party tools. Plugins extend Copilot's capabilities to pull live threat intelligence data. A is wrong because Promptbooks are pre-built sequences of prompts for specific investigation workflows, but they rely on plugins for external data. B is wrong because Skills are individual AI reasoning tasks within Copilot, not integration endpoints. D is wrong because Sessions are conversation contexts, not data integration mechanisms.