security-copilot

security-copilot is a skill for Claude Code, Codex from vinayaklatthe/microsoft-security-skills. It costs 154 tokens per session (1,608 once invoked), scanned A, original, MIT.

Guidance for Microsoft Security Copilot, a generative AI service that helps security teams investigate incidents, search for threats, summarize findings, and plan responses using natural-language requests.

In plain words
What is it for?
Use it for multi-step investigations, threat hunting, incident summaries, query explanations, policy explanations, and repeatable investigation workflows.
Why use it?
It reduces the time analysts spend interpreting security data, writing explanations, and assembling investigation summaries across different Microsoft security tools.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use it for multi-step investigations, threat hunting, incident summaries, query explanations, policy explanations, and repeatable investigation workflows.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/vinayaklatthe/microsoft-security-skills/security-copilot
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add vinayaklatthe/microsoft-security-skills --skill security-copilot
Clone the repo
git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for security-copilot

README.md
[![agentmods](https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/security-copilot/github.svg)](https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/security-copilot)
Your own site
<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/security-copilot"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/security-copilot/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for security-copilot

Your own site · 80×15
<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/security-copilot"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/security-copilot.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 154 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,608 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00154 $0.01608
Opus 5 $0.00077 $0.00804
Sonnet 5 $0.00031 $0.00322
Haiku 4.5 $0.00015 $0.00161

Measured 6d ago against content hash f3ac317cb3fa, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

security-copilot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/security-copilot/SKILL.md · 112 lines

How it starts

The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Microsoft Security Copilot

Microsoft Security Copilot is a generative-AI security platform that helps security and IT teams investigate incidents, hunt threats, summarise findings, and respond at machine speed using natural language, grounded in your security data and Microsoft threat intelligence.

When to use

Accelerating SOC investigation, reporting, and analyst productivity across Microsoft and third-party security data using natural-language workflows.

Do not use this skill for:

  • Configuring autonomous triage/remediation agents (use security-copilot-agents)
  • Building a SIEM analytics rule (use sentinel)
  • Configuring Defender XDR investigations or actions (use defender-xdr)

Pick the right experience for the task

Task Use this experience Why
Multi-step investigation across products Standalone portal Cross-plugin reasoning, promptbooks
Summarise this specific incident Embedded in Defender XDR Context already loaded
Explain or translate a KQL query Embedded in Sentinel Inline in the query editor
Explain a Conditional Access policy Embedded in Entra Policy already in scope
Repeatable investigation pattern Promptbook Saved, shareable, parameterised
Daily ad-hoc analyst question Standalone or embedded Either; pick by where you start

Rule of thumb: start embedded for single-product questions, switch to standalone the moment you need to correlate across two or more products. Promptbook anything you do more than twice.

Approach

  1. Provision capacity - Set up Security Compute Units (SCUs) in Azure (provisioned capacity model), assign the Azure subscription and resource group, choose the geographic region, and configure overage settings. SCUs are the meter; underprovisioning throttles, overprovisioning wastes spend. Verify: Security Copilot → Owner settings → Capacity shows SCUs reserved and the region matches your data residency requirement.
  2. Assign roles - Configure Security Copilot owner and contributor roles in Entra, align to least privilege, set the default environment, and decide on the data sharing toggle (model improvement opt-in/out). Verify: a non-owner test account can use Copilot but cannot change capacity settings.
  3. Enable plugins - Turn on the Microsoft plugins you need (Defender XDR, Sentinel, Intune, Entra, Threat Intelligence, Purview, Defender for Cloud) and add non-Microsoft or custom plugins where you have third-party data. Copilot respects the underlying product RBAC of the calling user - it never elevates privilege. Verify: a query that requires Sentinel data from a user without Sentinel access returns a permission error, not an answer.
  4. Choose the experience per workflow - Use the standalone portal for multi-step cross-product investigations, and the embedded experiences inside Defender XDR, Sentinel, Intune, Entra, and Purview for single-product context. Verify: analysts know which surface to start in for their top 5 daily tasks.
  5. Build promptbooks - Identify your top 5 repeatable workflows (incident summary for exec, reverse-engineer a script, KQL explanation, phishing email triage, CA policy explanation) and turn each into a promptbook with parameters. Verify: each promptbook runs end-to-end on a sample input without manual editing.
  6. Govern usage and consumption - Monitor SCU consumption per workload, audit Copilot activity, and set alerts on SCU utilisation > 80% to control cost. Review prompt logs for sensitive data exposure. Verify: a usage dashboard exists; alerting fires when SCUs trend high.
  7. Measure value - Track time-to-first-answer, analyst satisfaction, and SCU per resolved incident before and after rollout. If the metric does not move, the promptbooks or plugins are wrong, not the platform.

Read the full file on GitHub · 112 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 112 lines · 154 tokens per session scan A f3ac317cb3fa

Subscribe to this mod's changes

security-copilot is a skill published in the GitHub repository vinayaklatthe/microsoft-security-skills (172 stars, last pushed 2mo ago), licensed MIT. It adds 154 tokens to every session and 1,608 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

skill-meta-prompt

Craft better prompts using proven optimization techniques — use when your prompt needs refinement.

nyldn/claude-octopus · 19 tokens

coding-agents-prompt-authoring

To author, adapt, review, and validate prompts (skills, agents, workflows, rules, etc.) with brief, contracts, and a validation pack.

griddynamics/rosetta · 39 tokens

prompt-enhancer

Transform poor or overly simple prompts with expert-level framing. Use when the user explicitly asks to improve, refine, or rewrite a prompt, or wants help framing a request for another AI system. Do NOT use for authoring, reviewing, or migrating system prompts or skills targeting a specific Claude model…

sammcj/agentic-coding · 67 tokens

vendor-prompting

ANALYSIS SKILL — Audit-grade reference for Anthropic Claude and OpenAI GPT-5.6 prompting best practices. WHEN: "claude prompting", "gpt-5.6 prompting", "audit agent", "review prompt", "vendor best practices", "anthropic best practices", "openai prompting". DO NOT USE FOR: routine prompt edits where rules are already…

jonathan-vella/apex-accelerator · 94 tokens

llm-prompting-guide

Prompt format rules for generative video and music models. Use when writing or reviewing a prompt for MiniMax H3 (text/image/reference-to-video with native audio) or MiniMax Music 3 (song generation from caption plus lyrics), in ComfyUI or elsewhere. Do NOT use for chat-assistant prompts, or for generative models not…

sammcj/agentic-coding · 79 tokens

creating-prompts

Creates GitHub Copilot prompt files (.prompt.md) for VS Code. Use when building reusable workflow starters that route work to the right agent, collect the right inputs, and ship with install-ready templates, examples, and validation guidance.

jaktestowac/awesome-copilot-for-testers · 52 tokens