Merge pull request #1080 from millenniumfalcone/main

Update SecOps pillar docs

Author: tylchan

src/react/docs/workshop-guidance/securityoperations/SVA_AI001.md

@@ -0,0 +1,19 @@
+# Provision Security Copilot Units (SCUs)
+
+**Implementation Effort:** Medium — Provisioning SCUs requires IT and Security Operations teams to configure and manage capacity through Azure or the Security Copilot portal.  
+**User Impact:** Low — All actions occur at the admin level; non‑privileged users do not need to take any action.
+
+## Overview
+Security Compute Units (SCUs) provide the required capacity for Microsoft Security Copilot to run AI-driven security analysis workloads. Organizations that do not have Microsoft 365 E5 licensing must provision SCUs to enable Security Copilot. Administrators can increase or decrease SCUs from the Azure portal or the Security Copilot portal, and a usage monitoring dashboard helps them understand consumption over time. If SCUs are not provisioned—or the capacity is insufficient—Security Copilot may not operate or may perform poorly, weakening detection and investigation capabilities during active threats. This activity supports the **Zero Trust “Assume Breach”** principle by ensuring enough analytic capacity to rapidly detect, investigate, and respond to attacks.
+Security Copilot uses Microsoft Entra ID role-based access control (RBAC) to authorize access, and Microsoft recommends using the Microsoft Security roles group, which provides balanced access and administrative efficiency. This planning step protects sensitive security insights, prevents accidental exposure, and reduces the risk of unauthorized operations if roles are poorly scoped.
+
+### Where to configure this setting
+- **Azure Portal** — Adjust SCU quantity and configure overage.  
+- **Security Copilot Portal** — Track usage, view capacity dashboards, and tune allocation.  
+*(No configuration images are available in the source documentation.)*
+
+## Reference
+- [Security Compute Units and capacity](https://learn.microsoft.com/en-us/copilot/security/security-compute-units-capacity)  
+- [Get started with Microsoft Security Copilot](https://learn.microsoft.com/en-us/copilot/security/get-started-security-copilot)  
+- [Onboarding to Security Copilot for non-Microsoft 365 E5 customers](https://learn.microsoft.com/en-us/copilot/security/manual-onboarding)
+- [Understand authentication in Microsoft Security Copilot](https://learn.microsoft.com/en-us/copilot/security/authentication)

src/react/docs/workshop-guidance/securityoperations/SVA_AI002.md

@@ -0,0 +1,19 @@
+# Manage and Monitor Usage of Security Compute Units (SCUs)
+
+**Implementation Effort:** Medium — Administrators only need to perform targeted actions in the Security Copilot or Azure portal to view usage or adjust capacity.  
+**User Impact:** Low — Only administrators make changes; non-privileged users do not need to take any action.
+
+## Overview
+Security Compute Units (SCUs) define the processing capacity available to Microsoft Security Copilot. They determine how many security analyses, reasoning tasks, and automated workflows the service can run. Administrators can view real‑time and historical SCU consumption through built‑in dashboards in both the Security Copilot portal and the Azure portal. They can also scale SCUs up or down to meet operational needs.
+
+If SCU usage is not monitored or managed, organizations risk hitting capacity limits, which can delay or block Copilot‑assisted investigations, threat analysis, and automated responses. Ensuring SCU capacity is healthy supports the Zero Trust *Assume Breach* principle by maintaining continuous operational readiness for detection and response workflows.
+
+### Where to enable or configure
+- **Security Copilot Portal** → Usage dashboard (shows SCU consumption trends).  
+- **Azure Portal** → Security Copilot resource → **Capacity** (modify provisioned SCUs).
+
+
+## Reference
+- [Manage security compute unit usage in Security Copilot](https://learn.microsoft.com/en-us/copilot/security/manage-usage)  
+- [Security Compute Units and capacity in Microsoft Security Copilot](https://learn.microsoft.com/en-us/copilot/security/security-compute-units-capacity)
+  

src/react/docs/workshop-guidance/securityoperations/SVA_AI003.md

@@ -0,0 +1,21 @@
+# Manage Plugins in Microsoft Security Copilot
+
+**Implementation Effort:** Medium — Admins must configure, approve, and govern plugin access, which requires a defined project effort.  
+**User Impact:** Low — All actions occur on the admin side; non‑privileged users do not need to take action.
+
+## Overview
+Managing plugins in Microsoft Security Copilot allows administrators to control which external systems, security tools, threat‑intelligence sources, and internal data sources Copilot can access. Plugins extend Copilot’s ability to retrieve security context, execute actions, and connect to approved services. If plugins are not managed, the organization risks reduced Copilot effectiveness, inconsistent user experiences, or exposure of sensitive data to unapproved integrations.
+
+This supports the Zero Trust principle of **Verify Explicitly**, because each plugin must be explicitly reviewed and authorized before use.
+
+Admins can:
+- Enable or disable Microsoft, third‑party, and custom plugins  
+- Review plugin permissions  
+- Manage Model Context Protocol (MCP) plugins  
+- Control which integrations are available across the organization  
+
+## Reference
+- [Manage plugins in Microsoft Security Copilot](https://learn.microsoft.com/en-us/copilot/security/manage-plugins)  
+- [Use plugins in Microsoft Security Copilot](https://learn.microsoft.com/en-us/copilot/security/use-plugins)  
+- [Plugins overview for Microsoft Security Copilot](https://learn.microsoft.com/en-us/copilot/security/plugin-overview)  
+- [Model Context Protocol (MCP) plugins in Microsoft Security Copilot](https://learn.microsoft.com/en-us/copilot/security/plugin-mcp)

src/react/docs/workshop-guidance/securityoperations/SVA_AI004.md

@@ -0,0 +1,17 @@
+# Threat Hunting Agent (Microsoft Defender)
+
+**Implementation Effort: Medium** – This requires IT and Security Operations teams to configure access and incorporate the Threat Hunting Agent into existing Defender XDR hunting workflows, which is a project rather than a long‑term operational program.  
+**User Impact: Low** – Only administrators and security analysts interact with this capability; standard users do not need to take action.
+
+## Overview
+The Microsoft Security Copilot **Threat Hunting Agent** enhances Defender XDR’s advanced hunting by letting analysts ask questions in natural language and automatically generating, interpreting, and guiding threat‑hunting queries. It improves analyst efficiency by surfacing insights and walking them through end‑to‑end hunting sessions. Not deploying this tool may lead to slower threat detection, inconsistent query quality, and missed attacker activity because analysts must manually construct complex queries.  
+This capability supports the **Assume Breach** principle by improving visibility, accelerating threat detection, and helping analysts quickly investigate suspicious activity.
+
+### Where to configure/use it in the product
+You can access the Threat Hunting Agent in the Microsoft Defender portal:  
+**Microsoft Defender portal → Advanced hunting → Security Copilot Threat Hunting Agent** 
+
+
+## Reference
+- [Microsoft Security Copilot Threat Hunting Agent in Advanced Hunting](https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-security-copilot-threat-hunting-agent)
+

src/react/docs/workshop-guidance/securityoperations/SVA_AI005.md

@@ -0,0 +1,15 @@
+# Defender Threat Intelligence Agent
+
+**Implementation Effort:** Medium — IT and Security Operations teams must enable and integrate Microsoft Defender for Endpoint and Defender External Attack Surface Management so the agent has the required telemetry to operate effectively.  
+**User Impact:** Low — All actions occur within admin/SecOps workflows; non‑privileged users do not need to take any action or be notified.
+
+## Overview
+The Defender Threat Intelligence Agent (referred to in Microsoft Learn as the *Threat Intelligence Briefing Agent*) is an AI‑driven capability in Microsoft Security Copilot that generates tailored threat intelligence summaries based on signals from Microsoft Defender for Endpoint and Microsoft Defender External Attack Surface Management. It provides analysts with context-rich information on adversary activity, threat infrastructure, and relevant indicators, helping teams speed up investigations and identify active risks.  
+If this capability is not leveraged, security teams may miss correlations across Defender signals or spend more time manually gathering intelligence, increasing the risk of delayed detection and slower response.  
+This capability aligns to the Zero Trust principle of **Assume breach** by enhancing visibility, exposing attacker infrastructure, and improving threat detection quality.
+
+
+
+## Reference
+- [Threat Intelligence Briefing Agent — Microsoft Defender XDR](https://learn.microsoft.com/en-us/defender-xdr/threat-intel-briefing-agent-defender)  
+- [Threat Intelligence Briefing Agent — Microsoft Security Copilot](https://learn.microsoft.com/en-us/copilot/security/threat-intel-briefing-agent)

src/react/docs/workshop-guidance/securityoperations/SVA_AI006.md

@@ -0,0 +1,24 @@
+# View Incident Summaries and Use Guided Response to Remediate
+
+**Implementation Effort:** Low — Security administrators only need to perform targeted actions in Microsoft Defender XDR to view AI‑generated summaries and guided remediation steps.  
+**User Impact:** Low — Actions occur only within the admin/security team; no non‑privileged users are affected or notified.
+
+## Overview
+Security Copilot in Microsoft Defender XDR uses generative AI to summarize security incidents and provide guided remediation actions. Defender XDR automatically produces a clear, high‑value summary of the incident attack story, enabling analysts to understand what happened quickly. Security Copilot also uses AI and machine learning to contextualize the incident and generate recommended steps analysts can follow to investigate and remediate threats. These summaries and guided steps appear automatically in the Security Copilot pane within the attack story, helping teams reduce investigation time and improve response consistency. 
+
+If not implemented, analysts must manually correlate data across multiple Defender components, slowing down response and increasing the risk of delayed containment.
+
+**Zero Trust Principle:** *Assume Breach* — This capability helps reduce the blast radius by accelerating detection, investigation, and remediation.
+
+### Where to Enable / Configure
+You can access these capabilities directly in the **Microsoft Defender portal**:  
+1. Open **Microsoft Defender XDR**  
+2. Go to **Incidents**  
+3. Select an incident  
+4. The **Security Copilot** pane on the right displays the summary and guided response steps  
+
+
+## Reference
+- [Summarize an incident with Microsoft Copilot in Microsoft Defender](https://learn.microsoft.com/en-us/defender-xdr/security-copilot-m365d-incident-summary)  
+- [Triage and investigate incidents with guided responses](https://learn.microsoft.com/en-us/defender-xdr/security-copilot-m365d-guided-response)  
+- [Incident response and remediation with Security Copilot](https://learn.microsoft.com/en-us/copilot/security/use-case-incident-response-remediation)

src/react/docs/workshop-guidance/securityoperations/SVA_AI007.md

@@ -0,0 +1,18 @@
+# Analyze Potentially Malicious Files, Scripts, and Code with Microsoft Security Copilot
+
+**Implementation Effort:** Low — Security teams only need to enable and use built‑in Security Copilot capabilities, requiring targeted actions rather than ongoing programs.
+
+**User Impact:** Low — Only administrators and security analysts need to take action; no notification or action is required from end users.
+
+## Overview
+Microsoft Security Copilot provides AI-driven analysis for suspicious files, scripts, and command lines within the Microsoft Defender portal. Copilot can summarize file behavior, highlight suspicious elements, display certificates, API calls, strings, and provide contextual detection information to speed up investigation efforts. It also analyzes scripts by identifying malicious patterns, evaluating behavior, and producing security assessments with recommended remediation guidance. This accelerates the investigation process and reduces the time to identify threats.
+
+If this capability is not deployed, analysts must rely on manual reverse-engineering and static/dynamic analysis processes, which take more time and increase the risk that threats remain undetected, spread laterally, or exfiltrate data.
+
+**Zero Trust Connection — Assume Breach:**  
+This aligns with the “assume breach” principle by continuously validating potentially harmful code and enhancing threat detection visibility through AI-powered analysis.
+
+## Reference
+- [File analysis with Microsoft Copilot in Microsoft Defender](https://learn.microsoft.com/en-us/defender-xdr/copilot-in-defender-file-analysis)  
+- [Script analysis with Microsoft Copilot in Microsoft Defender](https://learn.microsoft.com/en-us/defender-xdr/security-copilot-m365d-script-analysis)  
+- [Investigate an incident's malicious script](https://learn.microsoft.com/en-us/copilot/security/investigate-incident-malicious-script)

src/react/docs/workshop-guidance/securityoperations/SVA_AI008.md

@@ -0,0 +1,21 @@
+# Review and Understand Details About Identities and Devices Using Microsoft Security Copilot
+
+**Implementation Effort:** Low — Only targeted actions by administrators are required; there is no large deployment project.
+
+**User Impact:** Low — No end‑user action or notification is needed; only administrators interact with this capability.
+
+## Overview
+Microsoft Security Copilot provides AI‑generated summaries of identity and device information to help security analysts understand user activity, alerts, authentication patterns, device health, and risks. The identity summary capability offers contextual insights about a user's behavior and exposure, speeding investigations and improving clarity (supported by Microsoft Defender for Identity). Device summaries automatically provide details such as risk level, configuration, and recent activity when viewing a device in Microsoft Defender.
+
+Security Copilot also assists in investigating identity‑based incidents and governance tasks within Microsoft Entra, including entitlement management, privileged identity workflows, and identity risk triage. Not enabling or using these capabilities can slow investigations, increase the chance of missed signals, and reduce visibility into identity and device security posture.
+
+This feature aligns to the Zero Trust principle of **Verify Explicitly**, because it surfaces deep contextual data about identities and devices before making access decisions or taking investigative actions.
+
+
+
+## Reference
+- [Summarize identity information with Microsoft Security Copilot](https://learn.microsoft.com/en-us/defender-xdr/security-copilot-defender-identity-summary)
+- [Summarize device information with Microsoft Security Copilot](https://learn.microsoft.com/en-us/defender-xdr/copilot-in-defender-device-summary)
+- [Security Copilot in Microsoft Entra](https://learn.microsoft.com/en-us/entra/security-copilot/security-copilot-in-entra)
+- [Investigate identity risk in Microsoft Security Copilot](https://learn.microsoft.com/en-us/entra/security-copilot/entra-investigate-incident)
+- [Identity Governance and optimization with Security Copilot](https://learn.microsoft.com/en-us/entra/security-copilot/entra-governance-optimization)

src/react/docs/workshop-guidance/securityoperations/SVA_Sentinel025.md

@@ -0,0 +1,23 @@
+# Consider Microsoft Defender Experts for XDR
+
+**Implementation Effort:** Medium – This requires IT and Security Operations teams to drive onboarding, validate licensing, and configure permissions for expert access.  
+**User Impact:** Low – All actions occur within admin/SOC workflows; non‑privileged users do not need to take action.
+
+## Overview
+Microsoft Defender Experts for XDR is a managed extended detection and response service that combines Microsoft’s automation and human security expertise to help SOC teams triage incidents, investigate threats, and accelerate response. It works across Microsoft Defender for Endpoint, Office 365, Identity, Cloud Apps, and Microsoft Entra ID. It reduces alert fatigue, improves prioritization, and ensures high‑severity threats are investigated with expert support [1](https://learn.microsoft.com/en-us/defender-xdr/dex-xdr-overview).  
+
+If this capability is not deployed, organizations risk slower threat detection, missed high‑priority incidents, insufficient SOC capacity, and reduced visibility into active threats.
+
+**Zero Trust Alignment:**  
+This capability supports the **Assume Breach** principle by adding continuous expert-driven monitoring, proactive threat hunting, and rapid containment actions to limit impact.
+
+### Where to Enable/Configure
+- Go to the **Microsoft Defender portal** → **Settings > Defender Experts > Get started** to begin onboarding and grant required permissions [2](https://learn.microsoft.com/en-us/defender-xdr/get-started-xdr).  
+
+## Reference
+- [What is Microsoft Defender Experts for XDR](https://learn.microsoft.com/en-us/defender-xdr/dex-xdr-overview)  
+- [Get started with Microsoft Defender Experts for XDR](https://learn.microsoft.com/en-us/defender-xdr/get-started-xdr)  
+- [How to use Microsoft Defender Experts for XDR](https://learn.microsoft.com/en-us/defender-xdr/start-using-mdex-xdr)  
+- [Before you begin using Defender Experts for XDR](https://learn.microsoft.com/en-us/defender-xdr/before-you-begin-xdr)  
+- [Communicating with Microsoft Defender Experts](https://learn.microsoft.com/en-us/defender-xdr/communicate-defender-experts-xdr)  
+- [Defender Experts for XDR Reports](https://learn.microsoft.com/en-us/defender-xdr/reports-xdr)