Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Integration scenarios allow you to start agentic sessions from other areas of the Microsoft Defender portal without navigating to Project Perception first.
What are integration scenarios?
Integration scenarios are in-context session initiation points that connect specific Microsoft Defender surfaces to Project Perception. When you're viewing an entity, you can immediately start an agentic session on that item without leaving the page using that entity as the input value for available playbooks.
Integration scenarios are available in:
- Cases
- Incidents
- Alerts
- Threat Intelligence Articles
Example: Run an agentic playbook from an incident
To start an agentic session from an incident:
- In the Microsoft Defender portal, go to Investigation & response > Incidents & alerts > Incidents.
- Select any incident to open its detail page.
- On the incident detail page, locate the Run Agentic Playbook button. The button appears near the top of the page, typically alongside other incident actions (you may need to click the three dots to view more)
- Select Run Agentic Playbook. A menu appears showing available playbooks.
- The menu displays only playbooks that:
- Accept an incident as input
- Have all required agents set up and enabledSelect a playbook from the menu.
- Select Start session.
The new session will appear in the Sessions list in Perception with an "In progress" status.
Equivalent Run Agentic Playbook buttons exist as actions on cases, alerts, and threat intelligence articles also.
Understand agentic playbook scoping
When you use integration scenarios, the agentic playbook menu shows only playbooks compatible with the current input type. This scoping ensures you don't see irrelevant playbooks.
If no playbooks are available for the input type, the Run Agentic Playbook button does not appear.
Benefits of integration scenarios
Integration scenarios provide several advantages:
- Reduced context switching: Start agentic sessions without leaving your current investigation.
- Faster response: Automate tasks immediately when you identify a relevant incident or threat.
- Contextual recommendations: See only playbooks relevant to the item you're investigating.
- Integrated workflow: Sessions appear in both Perception and the related incident or article detail page, creating a unified view.
Limitations
Integration scenarios have some limitations:
- Input type restrictions: Playbooks must be designed to accept the specific input type (incident or threat intelligence article). Playbooks that require other inputs (such as IP addresses or file hashes) are not available through integration scenarios.
- Agent access requirements: You must have the required role to use the agents in a playbook. If you do not have access, you will not be able to start the session.