Automating Sentinel triage with GitHub Copilot: a review of Chris Stelzer's Security Investigator

Credit where it's due. For the past three months, I've been running a tool that genuinely changed how I triage incidents, and the person who built it deserves a shout.

When you monitor 40+ tenants, Mean-Time-to-Respond is the number that rules your day. Threat actors iterate fast, and the tooling on the defender side has to keep up. So I started using the Security Investigator framework built by Chris Stelzer, and it's changed how I triage.

What it actually is

It's not a SaaS product or a portal. It's a framework that runs inside VS Code through GitHub Copilot's Agent mode. The clever part is the wiring: a set of MCP servers connected to Microsoft's security stack, plus 22 "Agent Skills", investigation workflows that Copilot loads based on what you ask.

You type something like "Investigate incident 12345" in plain English, Copilot detects the intent, pulls the right skill, runs schema-validated KQL, enriches the IOCs, and writes a report.

The MCP servers are where the flexibility lives. You get Sentinel Data Lake, Microsoft Graph, Sentinel Triage, KQL Search, and a few more. Being able to pick which MCP to point at matters a lot when every one of your 40+ tenants has different requirements and compliance constraints. For my workflow, the Sentinel Triage MCP is the one I reach for most, incident listing, alert detail, and Advanced Hunting in one place.

What it's like to run

My team had an incident flagged as a single user with a possible phishing click, the kind of alert that, on a busy day, gets a quick look. I pointed the Security Investigator at it, and within minutes, it had pulled the thread far enough to show this wasn't one user at all. It was a tenant-wide campaign: more than ten accounts affected by the same sender. The framework scoped it for me and laid out the obvious next moves - block the sender, reset passwords, revoke sessions.

The elephant in the room: Copilot's pricing

Here's the catch, and it's a real one. GitHub has been reshaping Copilot's model offering. As of 1st of June, the Opus model is no longer on Copilot Pro; you have to be on Pro+, and individual plans have moved to usage-based AI Credits. The "all-you-can-eat" era is over.

That hits a tool like this directly. The whole value comes from a strong model doing multi-step, tool-heavy reasoning across your telemetry. On the standard tier, you're not getting Opus-level intelligence anymore, and Sonnet 4.6 just doesn't cut it for me.

So I'm now looking for an alternative LLM/harness that lets me run a more capable model against the same MCP setup without GitHub's credit meter in the middle. The framework itself is harness-agnostic in spirit, it's MCP and Agent Skills, so this feels solvable. (If you've found a good answer here, please let me know.)

Bottom line

This is some of the most practical applied-AI work I've seen for a Microsoft SOC, and it's MIT-licensed. Chris has built something that turns ad-hoc threat hunts into reusable, version-controlled skills, a genuine DevOps mindset applied to security engineering.

Go play with it: https://github.com/SCStelz/security-investigator