(music)
- What if I told you that you could use
GPT-powered natural language
to investigate and respond to security incidents, threats,
and vulnerabilities facing your organization right now?
Well, today we're going to take a look
at how Microsoft's Security Copilot,
a new security AI assistant skilled
with Microsoft's vast cybersecurity expertise,
can help you perform common security-related tasks quickly
using generative AI.
And this includes embedded experiences
within the new Microsoft Defender XDR,
Microsoft Intune for endpoint management,
Microsoft Entra for identity and access management,
and Microsoft Purview for data security and much more.
And joining me today for a deeper dive into Security Copilot
is Ryan Munsch, who's on the team that built it.
- Thanks Jeremy. It's great to be here.
And I'm excited to share more about what we've done
with generative AI and security.
- This is a topic I've really been looking forward to
because I can see a lot of benefits here.
You know, security teams,
they're stretched pretty thin these days.
As we build more and more tools, though,
to help them harden security or detect
and respond to incidents,
it's still a struggle to parse through
all that information that's available to them
and respond quickly.
- Right, there are definitely skill
and staffing shortages at play here.
And when you add to that the increased frequency of attacks,
even the most skilled teams can benefit from generative AI.
In fact, think of Security Copilot
as an enterprise-grade natural language interface
to your organization's security data.
Let me show you.
I'm in the Microsoft Security Copilot right now.
Notice unlike other Microsoft Copilots,
it's a stateful experience to let you easily return
to investigations from previous Copilot sessions.
Now, this isn't an ordinary instance of GPT.
We've augmented the large language model training
with security skills so that it can work
with the signal in your environment,
and the more quality security signals
it has access to, the better.
In the bottom left corner are your managed plugins.
There's Microsoft Entra for identity,
Microsoft Intune for device endpoints,
Microsoft Defender plugins for incidents,
Threat Intelligence, and more,
as well as Microsoft Purview for data security
and Microsoft Sentinel, our cloud-based SIEM.
And you even have options for third-party plugins
like you see here with ServiceNow for incidents.
- This is a real breadth of information, then,
that basically Security Copilot
can use to help investigate incidents
and also generate informed responses later.
- Yeah, that's all data that can ground
and enrich the Security Copilot experience,
and the prompt experience brings additional skills too.
Notice like other Copilot experiences,
it proactively suggest prompts to get you started
like this one: "Show high severity incidents
and recent threat intelligence."
That said, it gets even more powerful
with multi-step sequences using Promptbooks.
I'll open this one for suspicious script analysis
to automate security process steps, and we can try it out.
I have a PowerShell script in my clipboard
that I'll paste into the prompt,
and in just a few moments,
Copilot has safely reversed engineered the malware
in the script with a step-by-step breakdown
of the tactics used by the exploit
in a way that's clear and understandable.
- Okay, so what's stopping someone, then,
from using maybe an off-the-shelf large language model?
And maybe a lot of people are going to say and think
that if I just use the right prompts,
I'll be able to get the response that I want.
- So that's partly true, but it's not quite that simple.
Let's demonstrate this together.
I'll use Security Copilot,
and you can use the GPT playground
using an unmodified GPT in the Azure OpenAI service.
We'll run the exact same prompts.
- Yep, let's do it. Sounds fun.
So right now, I've actually got the GPT playground open.
On the right, you're seeing my screen,
the Azure OpenAI Studio.
It's actually running a GPT-4 instance.
And on the left, you're seeing Security Copilot.
Now, we're going to start
with a Common Vulnerability and Exposure,
or CVE as we refer to it normally.
And Ryan and I are both going to submit the same prompts
and describe this particular CVE.
And that's going to take a moment to run and analyze the data,
especially on the Security Copilot side.
It's chewing through that and getting everything ready.
And when it's finished, you'll see
that the off-the-shelf model on the right,
it knows what a CVE is,
but otherwise, this response isn't useful at all.
So you saw on the Security Copilot side,
or you can see it now,
that it gives us the details for this CVE.
- So let's try something else.
We'll run another prompt.
We'll prompt it about a suspicious domain,
VectorsAndArrows.com.
Notice that while Security Copilot gathers the information
before formulating a response,
the GPT-4 instance on the right acknowledges
that it actually can't find the information.
Also, we can see here in Security Copilot's response
that it knows that if we're asking about this domain,
it likely involves a security event.
So it finds all of the matching IP addresses
that the domain resolves to,
the ASNs, or Autonomous System Numbers, related to it,
and corresponding organizations.
- And the differences that you're seeing here,
it's resulting in the fact
that the large language model that's off the shelf,
it relies on general training,
whereas prompts that were sent
to Security Copilot on your side,
they carry the security context
using all that fine tuning and grounding data
from all the plugins that you showed earlier.
- That said, of course the off-the-shelf model you use
could be grounded with more data,
and you can add up to three plugins
to provide additional security data.
But you'd still need to build an orchestration engine
to find and retrieve the data, rank it for relevance,
and then add the grounding data to your prompt
with guardrails to stay below your token limits
before presenting this information to the LLM
to generate an informed response.
And that's just scratching the surface.
For example, you'd also want to ensure
that it provides citations with the right legal assurances.
We do all of this and more right out of the box.
- All right, so I want to go back to the fine tuning aspect.
You know, we recently had Mark Russinovich on, CTO of Azure,
and he explained how a method
called Low-Rank Adaptive fine-tuning, or LoRA fine-tuning,
works to pinpoint LLM training specific
to a skill like security,
and this is a very specialized process.
So it's not as simple as building out your own solution
even if you were a security expert.
- Exactly, and ultimately, you need to understand
how the underlying AI processes work.
And we've done all of that work for you
based on our own extensive cybersecurity expertise.
We've been partnered with OpenAI for years now
on what it takes to build the most advanced models.
And so we have built an AI supercomputer
with a specialized hardware and software stack
in Azure to run them.
And with that foundation, we use the LoRA fine-tuning method
to give the LLM more training specific
to cybersecurity analysis, detection, response,
summarization, and more.
Then using evergreen Threat Intelligence
with real-time retrieval,
we also help ensure that it's always up-to-date
with new and trending threats.
And like I showed earlier,
we also provide built-in cyber-specific skills
in Promptbooks so that you can get multi-step prompts built
with insightful responses without being a prompt expert.
And this is something we've been working on for years
to get the processes and the LLMs' underlying knowledge base
up to the task of cybersecurity.
- Okay, so now you've explained how it works.
So can we walk through a process
maybe a security analyst might use
as they use Security Copilot to investigate an incident?
- Definitely; in some cases,
these investigations can start out
in something like Microsoft Defender
or simply as a support call, so let's start there.
In this case, I'm on an active call
with a user who can't access her device.
I'll prompt Security Copilot with, "What is the status
of the user account for Lynne Robbins?
Is it locked out?"
After reasoning across information
from its connected plugins,
it confirms that Lynne's account
is disabled with more details.
Let's keep going.
"What are the three most recent login attempts
from the user?"
And I got a few more clues back.
Lynne not only has had multiple failed login attempts,
but they've come from different devices and locations.
This account is likely compromised.
Now, I'll ask, "Is the user considered risky? If so, why?"
And it looks like she has a high risk level now,
but we need to find out more details.
So I'll prompt Copilot with a forward slash
to use a security-specific skill to generate
and run Defender hunting queries.
From the hunt, it's clear there is a ransomware event,
and lateral movement is occurring within Woodgrove.
We need to correlate it now with an incident
to see it in aggregate.
We can do that by checking for security incidents
on the same day, so I'll enter that prompt for that day.
Now, I'll expand the response,
and from the top line, I can correlate the alerts
with incident 1-9-3-8-8.
So now, I can simply ask for a summary of this incident.
I can assess everything captured by Defender
as well as anything related to the response process.
And I now know it's a potential
human-operated ransomware attack, and this is bad.
- Right, and this is a big deal
because all this went pretty quickly,
which is a huge advantage,
especially when you're trying trying to contain a threat.
- Yes, Security Copilot
can speed up investigation significantly.
In fact, to save a little more time showing the rest
of the investigation and also the statefulness of it,
I'll move to one that I've previously run.
Here's the incident we just looked up.
Beyond the severity level, we can also see
when the incident was first detected, the alert generation,
and a bunch of other information.
There are associated devices, threat actors, protocols used,
processes, and login attempts from our user, Lynne.
It tells me the investigation actions taken already
and some remediation actions taken
with real-time attack disruption
to automatically contain the threat.
And continuing on, I prompted it for associated entities.
It provided more devices, users, and IPs.
Then to start the remediation, I asked it
to generate a PowerShell script
to go check on the state of the device's SMB configuration,
which in our case was used
to move laterally between systems.
- And the script generation here is super-useful.
because when I write scripts,
it's always in short-term memory only,
so I have to look it up either in reference materials
and command line help, maybe ping Jeffrey Snover,
and then it kind of exits out the other side of my head.
- Yeah, my algebra teacher
had a similar complaint about my short-term memory.
But you're right, Security Copilot
can now solve the short-term memory problem.
Now, let's go and focus on the initial machine compromised.
Here, I used another skill to find host name access records
for the device in question, and it found one access record.
So we saw the lateral movement and a primary refresh token
which generated along the way.
Here I've generated a hunting query using Microsoft Sentinel
to figure out how the attacker did it
and look for security events associated with the IP address
on the day of the account lockout.
Security Copilot generated a Kusto Query Language,
or KQL, statement for me.
Then it runs that query for me here too.
All of this helps me understand the level
of attack infiltration across my network,
and next, I can move on to the devices associated
with our user, Lynne.
Here I've checked if the PARKCITY Win10S device
was compliant and it knew
where to pull the device information.
In this case, it's Intune.
It looks like the device was non-compliant,
failing to meet a Defender for Endpoint policy.
I don't work in the IT side of the house,
so next, I asked it for more information
about what the policy does
and why the device isn't compliant.
Looks like the device was not within the group scope
for the app policy assignment,
and as a result, the device was exposed
and became an attack target.
- And this really shows how easy it is, then,
to continue that investigation
maybe in areas where you're not an expert.
So what's the next step?
- Well, that's the great thing about Security Copilot,
is you don't have to be an expert to get expert advice.
And let's dive into Threat Intelligence,
in this case to understand the techniques in use
by the actor and other entry points they could exploit.
Our threat actor named from the incident summary
was pretty memorable for me,
so I prompted Security Copilot for some information
about the sea cow of threat actor groups, Manatee Tempest.
And this response, summary aside,
is the insight into different techniques used for exploits.
It's likely Lynne fell victim to a drive-by download.
But more importantly, what I learned
is that I need to rally my security organization
around analysis of any Cobalt Strike
or Mythic payloads placed in my environment.
And as an analyst, a lot of my time
is spent writing summary reports for people
who wouldn't be as deep as I am on an incident like this.
So I prompted Security Copilot
to provide a non-technical executive level summary
for our company leadership.
And using the session context,
it generated a thorough report
that's pretty easy to understand.
And again, just to highlight the transparency here,
if I expand the steps it took, then look at the first one,
you can see what process the orchestrator used
to develop a plan, gathered context from the session,
then determined which skills to use
as well as the rest of the logic and prompt details
that are presented to the fine-tuned LLM
to generate our response.
When finished, from here, I can download
and export it to a Word doc, Mail,
or just copy it to my clipboard.
And beyond high-level reports,
Copilot can even help generate more immediate summaries
for SecOp teams like pin boards.
As I was going, I selected the turns of my investigation
I wanted to highlight later using pins,
then used Copilot to generate a pin board summary
that I can share with my team
so that any new members joining
can quickly get up to speed on the work I've already done
without duplicating effort.
All of the prompts are saved to a stateful session,
and the entire investigation is shared
with all the context, including our pin board.
- And every phase of the investigation was sped up using
all the grounding data that was pulled
from quite a few different connected services,
for more context.
That said, though, in this case,
Lynne actually called the support desk,
which triggered your investigation.
So what would happen if this was maybe part of an incident?
- Well, that's actually a huge part of Security Copilot.
We've also built integrated experiences
across different Microsoft admin portals
to help save you time,
and this goes beyond security analyst roles too.
First, and to answer your question, in Microsoft Defender,
I have the incident number from before open here.
In the Security Copilot sidebar,
each incident automatically gets a generated summary,
and many of the standalone capabilities I showed before
can be done in context.
As you investigate alerts, it can analyze scripts
and commands in place like this one.
And in Advanced Hunting, you can use natural language
to author KQL queries with Security Copilot.
Then beyond Microsoft Defender, let me give you a quick look
at other embedded Copilot experiences that we have.
For endpoint admins, Security Copilot in Microsoft Intune
helps simplify policy management
so you can generate policies using natural language prompts,
find out more about settings, options, and their impacts,
and pull up critical details about managed devices.
If you're an identity admin,
Security Copilot in Microsoft Entra
will let you use the natural language to ask about users,
groups, sign-ins, and permissions
to instantaneously get a risk summary
as well as steps to remediate
and guidance for each identity at risk.
And in ID Governance, it can help you
to create a lifecycle workflow to streamline the process
to automate common task.
And one more, here's the experience for data security admins
in Microsoft Purview,
where Security Copilot with data loss prevention alerts
will quickly generate insights
about data and file activities.
And when used with Insider Risk Management,
alert summaries, find details about high-risk users
and the related data exfiltration activities
to help you respond fast.
And there are more embedded experiences to look forward to.
Security Copilot will also be integrated
with Microsoft Defender for Cloud and other plugins soon.
- So you can stay in the context, then,
of the tools that you use every day.
So for anyone who's watching right now
looking to get started, what do you recommend?
- If you're looking at options to use generative AI
with your security practices,
join our early access program at aka.ms/SecurityCopilot,
and you can even help shape what Security Copilot can do.
- Thanks so much, Ryan, for showing us
what Security Copilot can do to help us investigate
and respond to incidents using generative AI.
Of course, to stay up to date with all the latest tech,
be sure to subscribe to Mechanics, and thanks for watching.
(music)