# AI-Driven Guided Response for Security Operation Centers with Microsoft Copilot for Security

arXiv: https://arxiv.org/abs/2407.09017 · HTML: https://mlsanity.com/paper/2407.09017/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 51 references that are in the map.
- First posted on arXiv 12 Jul 2024.

## Builds on (most cited first, 5 of 5)

- [A Large-Scale Database for Graph Representation Learning](https://mlsanity.com/paper/2011.07682/) (2020)
- [Xpert: Empowering Incident Management with Query Recommendations via Large Language Models](https://mlsanity.com/paper/2312.11988/) (2023)
- [MalNet: A Large-Scale Image Database of Malicious Software](https://mlsanity.com/paper/2102.01072/) (2021)
- [REST: Robust and Efficient Neural Networks for Sleep Monitoring in the Wild](https://mlsanity.com/paper/2001.11363/) (2020)
- [IC-SECURE: Intelligent System for Assisting Security Experts in Generating Playbooks for Automated Incident Response](https://mlsanity.com/paper/2311.03825/) (2023)

## Built on by (most cited first, 7 of 7)

- [Large Language Models for Security Operations Centers: A Comprehensive Survey](https://mlsanity.com/paper/2509.10858/) (2025)
- [STAIR: Effective Incident Response Using an End-to-End Agentic Planning Framework](https://mlsanity.com/paper/2608.09524/) (2026)
- [Web Scale Graph Mining for Cyber Threat Intelligence](https://mlsanity.com/paper/2411.06239/) (2024)
- [GenAI-Driven Threat Detection with Microsoft Security Copilot](https://mlsanity.com/paper/2605.20896/) (2026)
- [From Chasing Ghosts to Missed Attacks: Perspectives and Perceptions of SOC Practitioners on LLM Integration, Risks, and Readiness](https://mlsanity.com/paper/2608.00672/) (2026)
- [It is Not Yet Another Tool: Creating and Deploying an Agentic AI Companion in a Security Operations Center](https://mlsanity.com/paper/2609.06250/) (2026)
- [HESP: Separating What to Probe from When to Stop in Local LLM Alert-Triage Agents](https://mlsanity.com/paper/2609.33446/) (2026)

## Abstract (arXiv)

Security operation centers contend with a constant stream of security incidents, ranging from straightforward to highly complex. To address this, we developed Microsoft Copilot for Security Guided Response (CGR), an industry-scale ML architecture that guides security analysts across three key tasks -- (1) investigation, providing essential historical context by identifying similar incidents; (2) triaging to ascertain the nature of the incident -- whether it is a true positive, false positive, or benign positive; and (3) remediation, recommending tailored containment actions. CGR is integrated into the Microsoft Defender XDR product and deployed worldwide, generating millions of recommendations across thousands of customers. Our extensive evaluation, incorporating internal evaluation, collaboration with security experts, and customer feedback, demonstrates that CGR delivers high-quality recommendations across all three tasks. We provide a comprehensive overview of the CGR architecture, setting a precedent as the first cybersecurity company to openly discuss these capabilities in such depth. Additionally, we release GUIDE, the largest public collection of real-world security incidents, spanning 13M evidences across 1M incidents annotated with ground-truth triage labels by customer security analysts. This dataset represents the first large-scale cybersecurity resource of its kind, supporting the development and evaluation of guided response systems and beyond.