A security operations team is using Microsoft Security Copilot to investigate a suspected phishing campaign. The analyst wants Security Copilot to automatically retrieve related indicators from Microsoft Defender Threat Intelligence. Which Security Copilot capability enables this integration?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — Plugins are correct because Security Copilot uses them to connect to external and Microsoft data sources, including Microsoft Defender Threat Intelligence. They let Copilot pull live threat intelligence data for your investigation.
Full Explanation
Plugins are correct because Security Copilot uses Plugins to connect to external and Microsoft data sources including Microsoft Defender Threat Intelligence, Microsoft Sentinel, Defender XDR, and third-party tools. Plugins extend Copilot's capabilities to pull live threat intelligence data. Promptbooks are wrong because they are pre-built sequences of prompts for specific investigation workflows, but they rely on plugins for external data. Skills are wrong because they are individual AI reasoning tasks within Copilot, not integration endpoints. Sessions are wrong because they are conversation contexts, not data integration mechanisms.