A SOC team wants to integrate Microsoft Security Copilot with a third-party SOAR platform (Splunk SOAR) so that Copilot can be invoked from Splunk playbooks during incident response. Which integration mechanism supports this?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Microsoft Security Copilot exposes a REST API that external systems can call programmatically using OAuth 2.0 authentication. Splunk SOAR playbooks can make authenticated REST API calls to Security Copilot, passing prompts and receiving AI-generated responses to incorporate into automated incident response workflows.
Full explanation below image
Full Explanation
B is correct because Microsoft Security Copilot exposes a REST API that external systems can call programmatically using OAuth 2.0 authentication. Splunk SOAR playbooks can make authenticated REST API calls to Security Copilot, passing prompts and receiving AI-generated responses to incorporate into automated incident response workflows. A is wrong because while Microsoft Security Copilot may have future Logic Apps connectors, direct REST API integration is the documented approach for third-party SOAR integration. C is wrong because a Sentinel playbook calling Splunk via webhook is a Sentinel-to-Splunk integration, the opposite of what is needed (Splunk invoking Copilot). D is wrong because the Microsoft Graph Security API provides access to security alerts and incidents across Microsoft products, not to the Security Copilot inference API.