Microsoft Events presents a practical guide to AI-driven, controlled responses in Microsoft Sentinel, featuring Blink micro agents and workflow automation tools for security teams.

Sentinel Alert to Autonomous Action: Controlled AI Response Framework

Learn how to accelerate incident response in Microsoft Sentinel with an AI-powered automation framework presented at Microsoft Ignite.

Key Topics

Blink Platform Capabilities: Demonstration of Builder Copilot and Analyst Copilot for building and managing security automation.
Workflow Editor: Tips on using Blink’s integrated tools to design reusable workflows.
Alert Verification: How Sentinel sends alerts to Microsoft Teams and how AI agents verify responses.
AI Agents vs LLMs: Exploring the differences between Large Language Models and specialized AI agents for security operations.
Agent Responsibilities: Using AI agents to investigate Sentinel alerts, including hands-on KQL query examples for advanced threat hunting.
Controlled Automation: Frameworks for fast, safe, and environment-specific security remediation.

Workflow Highlights

Automate workflow creation and response steps with Builder Copilot
Use Analyst Copilot for investigation and validation
Integrate alert messaging with Microsoft Teams
Configure custom micro agents to trigger, investigate, and resolve incidents

Further Resources

Presenter

Joshua Weinick shares insights for intermediate/advanced security practitioners.

Conclusion

Expand automation capabilities in Sentinel beyond simple alerting to full-lifecycle, AI-driven incident workflows.