Microsoft patents AI agents that investigate security alerts automatically
Microsoft describes a system where an AI 'analyst' agent receives a security alert and breaks it down into smaller parts. It then assigns specific AI agents to check each part for threats, combining their findings into a final decision on whether the alert is a real attack or a false alarm.
In the filing’s own words
A computing system for an automated artificial intelligence security operations center alert investigation includes processing circuitry configured to implement an automated artificial intelligence (AI) security operations center (SOC) investigation program. The AI SOC investigation program includes an automated SOC analyst (SA) investigation agent that receives a trigger to initiate an investigation for a security alert, retrieves alert evidence data including at least one entity related to the security alert, implements an investigation workflow to determine one or more entity investigation agents to investigate the entity, and implements the one or more entity investigation agents to investigate the entity. The SA investigation agent receives one or more respective intermediate verdicts from the one or more entity investigation agents, the one or more intermediate verdicts indicating whether the entity is malicious or benign, and determines a final verdict for the security alert based on the one or more intermediate verdicts.
What exactly they claim (claim 1)
1. A computing system for an automated artificial intelligence security operations center alert investigation, comprising: a computing device including processing circuitry configured to execute instructions using portions of associated memory to implement an automated artificial intelligence (AI) security operations center (SOC) investigation program, the automated AI SOC investigation program including an SOC analyst (SA) investigation agent, wherein the SA investigation agent is configured to: in an inference phase: receive a trigger to initiate an investigation for a security alert; retrieve alert evidence data, the alert evidence data including at least one entity related to the security alert; implement an investigation workflow to determine one or more entity investigation agents to investigate the at least one entity included in the alert evidence data; implement the determined one or more entity investigation agents to investigate the at least one entity; receive one or more respective intermediate verdicts from the one or more entity investigation agents, the one or more respective intermediate verdicts indicating whether the at least one entity is malicious or benign; and determine a final verdict for the security alert based on the one or more respective intermediate verdicts.
Facts
- Company
- Microsoft (Microsoft Technology Licensing, LLC)
- Official title
- AUTOMATED ARTIFICIAL INTELLIGENCE SECURITY OPERATIONS CENTER INVESTIGATION AGENT
- Publication number
- US20260278083A1
- Application number
- 19082155
- Filed
- Mar 17, 2025
- Published
- Sep 17, 2026
- Inventors
- 11
- Claims
- 20
Classified under
G06F 21/554 Physics & computingG06F 2221/034 Physics & computingMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.