Microsoft patents AI agent that skips deep security checks when alerts are clear
Microsoft describes a system that uses an AI agent to investigate security alerts. It first checks if the alert is clearly safe or dangerous using specific rules; if the answer is unclear, it launches a deeper investigation to examine the details.
In the filing’s own words
A computing system for an adaptable automated artificial intelligence security operations center alert investigation implements an automated artificial intelligence (AI) security operations center (SOC) investigation program via an automated SOC analyst (SA) investigation agent. The SA investigation agent initiates an investigation for a security alert and retrieves alert data including an entity. An adaptability agent processes the alert data according to adaptability criteria to reach an adaptability verdict. If the adaptability verdict indicates the security alert is malicious or benign, then the SA investigation agent refrains from implementing an investigation workflow and outputs a final verdict. If the adaptability verdict is indeterminate, then the SA investigation agent implements the investigation workflow to determine entity investigation agents to investigate the entity. The SA investigation agent receives intermediate verdicts from the entity investigation agents indicating whether the entity is malicious or benign, and determines a final verdict for the security alert.
What exactly they claim (claim 1)
1. A computing system for an adaptable automated artificial intelligence security operations center alert investigation, comprising: a computing device including processing circuitry configured to execute instructions using portions of associated memory to implement an adaptable automated artificial intelligence (AI) security operations center (SOC) investigation program, the adaptable automated AI SOC investigation program including an SOC analyst (SA) investigation agent, wherein the SA investigation agent is configured to: in an inference phase: receive a trigger to initiate an investigation for a security alert; retrieve alert evidence data, the alert evidence data including at least one entity related to the security alert; and implement an adaptability agent to evaluate the security alert based on user-defined adaptability criteria, the adaptability agent including an adaptability tool that is configured to process the alert evidence data according to user-defined adaptability criteria to reach an adaptability verdict, wherein if the adaptability verdict indicates the security alert is malicious or benign, then the SA investigation agent is configured to: refrain from implementing an investigation workflow; and output a final verdict that indicates the security alert is malicious or benign, and if the adaptability verdict is indeterminate, then the SA investigation agent is configured to: implement an investigation workflow to determine one or more entity investigation agents to investigate the at least one entity included in the alert evidence data; implement the determined one or more other entity investigation agents to investigate the at least one entity; and receive one or more respective intermediate verdicts from the one or more entity investigation agents, the one or more respective intermediate verdicts indicating whether the at least one entity is malicious or benign; and determine a final verdict for the security alert based on the one or more respective intermediate verdicts.
Facts
- Company
- Microsoft (Microsoft Technology Licensing, LLC)
- Official title
- ADAPTABLE AUTOMATED ARTIFICIAL INTELLIGENCE SECURITY OPERATIONS CENTER INVESTIGATION AGENT
- Publication number
- US20260281127A1
- Application number
- 19082158
- Filed
- Mar 17, 2025
- Published
- Sep 17, 2026
- Inventors
- 11
- Claims
- 20
Classified under
H04L 63/1416 Electricity & electronicsH04L 63/1425 Electricity & electronicsMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.