We like that we can describe what we want in plain English and get a working KQL query we can tweak. It saves a lot of time—around 20 to 30 minutes per investigation. Incident summaries turn long alert timelines into short, readable explanations, and script and code analysis helps us quickly check suspicious PowerShell or command-line activity by breaking down what it does step by step. Promptbooks let us reuse common investigation steps. The integrations with Defender, Sentinel, Intune, and Entra work smoothly, so we don’t have to switch between tools. It cuts down the time developers spend making sense of alerts, reduces back-and-forth with the SOC team, and helps engineers without deep security knowledge investigate threats as part of their normal workflow. Setup was fairly easy, Microsoft’s documentation was helpful, and our team was productive within the first week. Review collected by and hosted on G2.com.

I find the Security Compute Unit pricing hard to predict and it can get expensive, so I have to watch usage closely. Generated KQL is sometimes wrong or uses the wrong table, so I still need to validate it. Responses can be slow for complex prompts, which hurts during urgent incidents, and session context gets lost in longer investigations, so I have to repeat details. Integration outside the Microsoft ecosystem is limited, and developers still have to copy and paste findings instead of working directly in our IDE, GitHub, or CI/CD pipelines. Setup was fairly easy, but configuring roles and permissions and deciding how much SCU capacity we needed were trickier parts. Review collected by and hosted on G2.com.