Detect and Respond to Risky AI Data Activity

Close the loop — turn AI audit signals, insider-risk indicators, and communication-compliance findings into investigation and response, bridged into Defender XDR and Sentinel.

Core capabilities

AI and Agent Activity Audit Microsoft Purview

Capture the prompt-and-response audit trail that every AI data investigation starts from
Insider Risk Signals for AI Activity Microsoft Purview Insider Risk Management

Identify users with risky AI behavior and correlate the signals into Defender XDR incidents for unified investigation
Communication Compliance for AI Interactions Microsoft Purview

Detect regulatory, inappropriate, or risky content in prompts and responses that policy violations produce
Agent Threat Detection Microsoft Defender XDR

Detect jailbreak, prompt-injection, and credential-leak attacks against agents and drive the security response

Supporting capabilities 3

Purview DSPM AI Interaction Discovery Microsoft Purview Data Security Posture Management

Provide the risk context and activity baseline that response teams triage against
eDiscovery for Agent Interactions Microsoft Purview

Preserve and export AI interaction evidence once an incident is confirmed
Copilot Activity Investigation Microsoft Sentinel

Correlate Copilot and AI activity with broader SIEM telemetry for end-to-end hunting and response

Core capabilities

Solutions

Further reading