SOC Weekly Brief Agent
The SOC Weekly Brief Agent generates a weekly SOC leadership briefing with week-over-week comparison from Microsoft Sentinel and Defender XDR evidence. It surfaces operational trends, efficiency metrics (MTTT/MTTC), MITRE ATT&CK trends, automation health, recurring patterns, and projections—formatted in Markdown for SOC governance, service reviews, and CISO inputs.
Customer value
- Saves 60–120 min weekly by consolidating data from queues, dashboards, alert pages, and workbooks into a single brief.
- Surfaces week-over-week trends with deltas, regressions, and improvements—not just raw counts.
- Service-review ready output with executive summary, prioritized SOC Manager actions, and audit/data-quality notes.
- Operational projections for next week based on current and previous weekly patterns—read-only boundary preserved.
At a glance
Lookback
Fixed 7-day current week vs. 7-day previous week comparison.
Trigger
WeeklyRun schedule, manual run, or Chat with agent.
Output
Markdown brief designed for service reviews, governance meetings, and CISO inputs.
Every 7 days
Markdown
Weekly brief workflow
1) Define windows
Sets the current week (last 7 days) and the previous week (the 7 days immediately before) for week-over-week comparison.
2) Collect & normalize
Sentinel: SecurityIncident, SecurityAlert, automation health, SecOps Efficiency
Defender XDR: incident, alert, entity, and evidence context
Operational: queue, assignment, backlog, closure quality
3) Compare & analyze
Calculates deltas, identifies increases, decreases, improvements, regressions, and interprets the operational meaning behind the changes.
4) Project & report
Generates cautious next-week projections and produces a structured Markdown brief with prioritized SOC Manager actions.
Enablement & how to run
Required skillsets
Sentinel
M365 (Defender XDR / Advanced Hunting)
Generic
Agent package skillset (orchestrator, chat, report generator + KQL skills)
Prerequisites
Microsoft Sentinel workspace with read access to incidents and entities.
Security Copilot workspace access with Security Reader (or equivalent).
Deployment steps
1) Set up SOC Weekly Brief Agent in the Microsoft Security Store.
2) Enable required skillsets.
3) Validate via manual runs for 3–5 weekly cycles.
4) Enable WeeklyRun before the weekly SOC governance meeting.
Want week-over-week SOC governance with zero manual effort?
Contact us to enable SOC Weekly Brief Agent and generate automated weekly leadership briefings with trend analysis, MITRE comparisons, and next-week projections.
Schedule-driven. Evidence-based. Markdown-only output suitable for SOC governance, service reviews, and CISO inputs.
