Data Leak Agent

Data Leak Agent investigates Microsoft Defender XDR incidents for evidence of data leakage, data exfiltration, suspicious exposure, collection, or staging.

Using a required numeric Incident ID from the unified Microsoft Defender portal, the agent retrieves the incident and its material entities, then investigates related activity beyond the alerts already attached to the case. It correlates Defender XDR telemetry with Microsoft Purview DLP, Insider Risk, data risk, sensitivity, and data security evidence when available.

This release supports incident-led investigation only. It does not perform proactive tenant-wide hunting and does not require Microsoft Sentinel workspace configuration.

Inputs

• Incident ID - required: Numeric incident identifier displayed in the unified Microsoft Defender portal.

• Lookback Days - optional: Correlation period from 1 through 90 days. The default is 30 days.

Tasks

The agent validates and resolves the incident, extracts and prioritizes relevant users, devices, files, hashes, IP addresses, alerts, messages, and destinations, and establishes a focal investigation window.

It correlates incident-derived entities with available Microsoft Purview and Defender XDR evidence, including DLP and Insider Risk signals, sensitivity information, unusual activity, sensitive-file access, archive staging, removable-media and network-share copies, transfer tools, network connections, cloud data movement, external sharing, and outbound email attachments.

The agent distinguishes evidence from indicators, considers plausible authorized business activity, and treats unavailable or failed telemetry as an investigation limitation rather than as a zero-result finding.

Outputs

The agent generates a concise Markdown report containing:

• Verdict, confidence, and executive rationale

• Incident summary and material entities

• Up to five prioritized findings

• Microsoft Purview findings

• Correlated timeline of up to ten material UTC events

• Evidence supporting or reducing the likelihood of exfiltration

• Investigation limitations and recommended analyst actions

Verdicts are Confirmed, Highly likely, Suspicious, No supporting evidence found, or Inconclusive. Confidence is High, Medium, or Low.

Requirements and permissions

• Security Copilot access that permits execution of installed agents

• Microsoft Defender XDR read access to relevant incidents, alerts, entities, and Advanced Hunting data

• Appropriate Microsoft Purview role-group access for DLP, Insider Risk, Data Security Investigations, and related data scopes

• Required Microsoft security products must be licensed, deployed, onboarded, and generating telemetry

The incident must be accessible in the unified Microsoft Defender portal. The agent is read-only and does not automatically contain entities, remediate activity, close incidents, or modify security controls.

Key capabilities

• Defender XDR incident-led data leak investigation

• Microsoft Purview DLP and Insider Risk correlation

• Entity-scoped multivector evidence collection

• Evidence-based verdict and confidence assessment

• Source-aware, bounded, and fault-isolated execution

Security Copilot Units - SCU consumption

Estimated consumption per execution:

• Small environments: approximately 1.2 SCUs

• Medium environments: approximately 1.4 to 2.1 SCUs

• Enterprise environments: approximately 2.3 to 2.9 SCUs

Actual consumption varies with incident complexity, lookback period, integrations, entity count, and telemetry volume.

--

Version: 2.0.1

Change log:

• Redesigned the agent as an incident-led investigation for potential data leakage and exfiltration in the unified Microsoft Defender XDR portal.

• Expanded Microsoft Purview correlation across DLP, Insider Risk, data risk, sensitivity, unusual activity, and data security behaviors.

• Improved reliability through telemetry checks, schema-safe Advanced Hunting queries, bounded processing, failure isolation, and explicit investigation limitations.