Skip to content

Add SecurityAnalysisAgent-OuterLoop Logic Apps#221

Open
eldorodo wants to merge 2 commits into
Azure:mainfrom
eldorodo:security-analysis-agent-outerloop
Open

Add SecurityAnalysisAgent-OuterLoop Logic Apps#221
eldorodo wants to merge 2 commits into
Azure:mainfrom
eldorodo:security-analysis-agent-outerloop

Conversation

@eldorodo

@eldorodo eldorodo commented Jun 4, 2026

Copy link
Copy Markdown
Collaborator

Summary

Adds two Azure Logic App ARM templates for the Security Analyst Agent (OuterLoop) automation in Microsoft Security Copilot.

What's included

  • azuredeploy-email-datalake.json — Logic App for Sentinel Data Lake variant
  • azuredeploy-email-LAW.json — Logic App for Log Analytics Workspace variant
  • readme.md — Documentation with Deploy to Azure buttons, parameters, and sample output
  • images/ — Sample email report screenshots

How it works

Each Logic App runs on a configurable schedule, sends a security analysis prompt to the SecurityAnalysisAgentOuterLoop skill, generates an HTML dashboard, and emails the report via Office 365.

@eldorodo eldorodo assigned eldorodo and unassigned eldorodo Jun 4, 2026
@eldorodo

eldorodo commented Jun 4, 2026

Copy link
Copy Markdown
Collaborator Author

@microsoft-github-policy-service agree

@eldorodo

eldorodo commented Jun 4, 2026

Copy link
Copy Markdown
Collaborator Author

cc @divyamsingh97 for review

@eldorodo

eldorodo commented Jun 4, 2026

Copy link
Copy Markdown
Collaborator Author

@microsoft-github-policy-service agree

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds deployable Azure Logic App ARM templates plus documentation for scheduling and emailing Security Analyst Agent (OuterLoop) reports from Microsoft Security Copilot, supporting both Sentinel Data Lake and Log Analytics Workspace data sources.

Changes:

  • Added two ARM templates to run the OuterLoop skill on a schedule and email an HTML dashboard report.
  • Added documentation with Deploy-to-Azure links, parameters, and sample email screenshots.

Reviewed changes

Copilot reviewed 3 out of 8 changed files in this pull request and generated 6 comments.

File Description
Logic Apps/SecurityAnalysisAgent-OuterLoop/azuredeploy-email-LAW.json New Logic App ARM template for Log Analytics Workspace-backed runs and email delivery.
Logic Apps/SecurityAnalysisAgent-OuterLoop/azuredeploy-email-datalake.json New Logic App ARM template for Sentinel Data Lake-backed runs and email delivery.
Logic Apps/SecurityAnalysisAgent-OuterLoop/readme.md New deployment and usage documentation for both template variants.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +80 to +83
"SecurityCopilotConnectionName": "[concat('SecurityCopilot-', parameters('PlaybookName'))]",
"Office365ConnectionName": "[concat('Office365-', parameters('PlaybookName'))]",
"FinalUserRequest": "[concat(parameters('UserRequest'), ' This is the final intent, do not ask clarification questions.')]",
"SkillInputsJson": "[concat('{\"UserRequest\":\"', variables('FinalUserRequest'), '\",\"DataSource\":\"SentinelLogAnalyticsWorkspace\",\"LogAnalyticsWorkspaceSubscriptionId\":\"', parameters('LogAnalyticsWorkspaceSubscriptionId'), '\",\"LogAnalyticsWorkspaceResourceGroupName\":\"', parameters('LogAnalyticsWorkspaceResourceGroupName'), '\",\"LogAnalyticsWorkspaceName\":\"', parameters('LogAnalyticsWorkspaceName'), '\"}')]"

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Acknowledged, will consider in a future iteration.

Comment on lines +144 to +145
"SkillName": "SecurityAnalysisAgentOuterLoop",
"SkillInputs": "[concat('@json(''', variables('SkillInputsJson'), ''')')]"

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Acknowledged, will consider in a future iteration.

Comment on lines +187 to +189
"Subject": "Security Analyst Agent - Executive Report",
"Body": "<p>@{body('Submit_a_Security_Copilot_prompt_1')?['EvaluationResultContent']}</p>",
"Importance": "Normal"

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Acknowledged, will consider in a future iteration.

Comment on lines +69 to +72
"SecurityCopilotConnectionName": "[concat('SecurityCopilot-', parameters('PlaybookName'))]",
"Office365ConnectionName": "[concat('Office365-', parameters('PlaybookName'))]",
"FinalUserRequest": "[concat(parameters('UserRequest'), ' This is the final intent, do not ask clarification questions.')]",
"SkillInputsJson": "[concat('{\"UserRequest\":\"', variables('FinalUserRequest'), '\",\"DataSource\":\"SentinelDataLake\",\"SentinelDataLakeWorkspaceName\":\"', parameters('SentinelDataLakeWorkspaceName'), '\"}')]"

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Acknowledged, will consider in a future iteration.

Comment on lines +133 to +134
"SkillName": "SecurityAnalysisAgentOuterLoop",
"SkillInputs": "[concat('@json(''', variables('SkillInputsJson'), ''')')]"

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Acknowledged, will consider in a future iteration.

Comment on lines +176 to +178
"Subject": "Security Analyst Agent - Executive Report",
"Body": "<p>@{body('Submit_a_Security_Copilot_prompt_1')?['EvaluationResultContent']}</p>",
"Importance": "Normal"

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Acknowledged, will consider in a future iteration.

@eldorodo

eldorodo commented Jun 4, 2026

Copy link
Copy Markdown
Collaborator Author

Re: Copilot review comments (all 6)

Acknowledged. These are intentional design choices for this Logic App template:

  • The UserRequest parameter is controlled at deploy-time and doesn't contain untrusted input
  • The <p> wrapper in the email body works correctly with Office 365 connectors in practice

Will consider refactoring in a future iteration. Thanks for the suggestions!

@eldorodo

Copy link
Copy Markdown
Collaborator Author

Hi @divyamsingh97, could you please review this PR when you get a chance? Thank you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants