AI Assist: AI Triage on Every Alert
AI Assist reviews each behavior alert before an analyst has to. It gathers the evidence around the alert, decides whether it needs action, explains its reasoning, and closes the alerts that do not — so analysts spend their time on the ones that do.
After a beta with early customers, AI Assist is rolling out to all instances in stages.
How it works
- An investigation per alert. A lead agent receives the alert and hands focused questions to specialist agents — about the user's sign-in history, the account's age and role, the devices and networks involved — then reaches a verdict from everything they return.
- Workflows for the common cases. Dedicated workflows handle the alerts that make up most of the volume: new-user sign-ins, authentication-method changes, and sign-ins from a new ISP or location, including impossible travel.
- A decision you can read. The verdict and the reasoning behind it appear with the alert and in the alert email.
- Closed by AI. An alert AI Assist judges not actionable is closed and marked as closed by AI. Actionable alerts are escalated as before.
What you need
AI Assist works on the data your instance already collects. Instances with the Office 365 Resource Watch application installed give it user records — roles, account creation dates — that make its decisions on Microsoft 365 alerts more precise.
Splash Summary
AI Assist reviews each behavior alert before an analyst has to. It gathers the evidence around the alert, decides whether it needs action, explains its reasoning, and closes the alerts that do not — so analysts spend their time on the ones that do.
After a beta with early customers, AI Assist is rolling out to all instances in stages.