AI SOC Live: Episode 2
Maximize Your Microsoft Security Investment

Hosted by

Shaul Holtzman

Director, Solutions Engineering

Shaul Holtzman is a cybersecurity leader with experience in SecOps, incident response, malware analysis, and forensics. Shaul is on a mission to prove that an Autonomous SOC is achievable.

Sarah Breathnach

AI SOC Community Builder

Sarah Breathnach is a marketing leader in the cybersecurity space. Sarah is an experienced webinar host who’s passionate about helping cyber security professionals tell their stories to new audiences.

Episode key takeaways

What is AI Triage in a SOC?

AI Triage is the use of artificial intelligence to automatically review and classify security alerts before they reach a human analyst. Instead of relying only on severity labels, AI triage evaluates evidence across endpoint, identity, email, and cloud telemetry. This helps SOC teams investigate more alerts faster and reduce missed threats.

What is Microsoft Alert Triage?

Microsoft Alert Triage is the process of reviewing alerts from Microsoft Defender, Microsoft Sentinel, and Microsoft XDR to determine which ones represent real threats. The challenge is that Microsoft environments generate high alert volume, and many SOC teams cannot investigate everything. AI-driven triage helps reduce noise by automatically identifying false positives and prioritizing true incidents

What is AI investigation, and why does it matter for security teams?

AI investigation is the automated collection and analysis of security evidence to determine whether an alert is malicious. It can include file reputation checks, identity login behavior, network activity, endpoint telemetry, and phishing link analysis. This matters because SOC teams often lack the time to fully investigate every alert manually.

How does an AI SOC improve Microsoft Alert Triage?

An AI SOC improves Microsoft Alert Triage by automatically investigating alerts across Microsoft Defender, Sentinel, and Microsoft 365 security data. Instead of forcing analysts to manually correlate logs and signals, the AI SOC aggregates evidence, reduces false positives, and escalates only high-confidence threats. This enables organizations to reach closer to 100% alert coverage

Can Microsoft Copilot replace AI SOC automation?

No — Microsoft Copilot is best used after initial triage, when analysts want to ask questions, run queries, or deepen an investigation. AI SOC automation is designed to do the first step: triage, evidence collection, correlation, and classification before the analyst ever touches the alert. In other words, Copilot supports the analyst, while AI SOC reduces the workload at scale.

Why do Microsoft SOC teams still rely on service providers?

Many Microsoft SOC teams rely on service providers because Microsoft environments can generate overwhelming alert volume and require constant tuning. Even with strong tools, SOC teams struggle to investigate every alert and often outsource triage and response. AI SOC automation makes it possible to bring more investigation work back in-house while maintaining speed and coverage.

Why are organizations bringing the SOC back in-house using AI?

Organizations are bringing the SOC back in-house because AI makes it possible for small teams to manage large-scale alert volumes without relying on MDRs or service providers. Instead of outsourcing triage due to capacity limits, teams can automate investigation and escalate only true threats. This restores control over security decisions, workflows, and response timelines.

How does AI SOC help reduce dependence on MDR providers?

AI SOC reduces dependence on MDR providers by automating triage and investigation across Microsoft Defender, Sentinel, and identity signals. SOC teams no longer need external analysts to handle alert volume or repetitive investigations. With AI investigation done automatically, internal teams can focus on escalation, containment, and strategic improvements.

What is the biggest challenge with Microsoft Alert Triage?

The biggest challenge with Microsoft Alert Triage is not visibility—it’s volume. Microsoft security products generate high-quality detections, but SOC teams still struggle to investigate all of them. AI triage solves this by reviewing every alert consistently and reducing noise before it hits analysts.

What is the best workflow for using Microsoft Copilot in a SOC?

The best workflow is to use AI SOC automation first for triage and evidence collection, then use Microsoft Copilot for deeper follow-up questions. Copilot is most valuable once the SOC already has context and needs fast querying or enrichment. AI SOC ensures the analyst starts with a complete investigation instead of a raw alert.