Data Leak Agent

Data Leak Agent investigates a user-provided incident to determine whether it indicates data leak, data exfiltration, or related suspicious data exposure activity. The agent automatically correlates evidence across Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Purview to produce a single, evidence-based assessment.

It retrieves incident context, related entities, and supporting telemetry from both Sentinel and Defender XDR, then enriches the investigation with Purview insights such as DLP alerts, data risk summaries, and user risk activity within the selected lookback window. The result is a structured investigation report that helps analysts quickly understand whether the incident is likely associated with data leakage or exfiltration, what evidence supports that conclusion, and what follow-up actions are recommended.

This agent is designed to:

• Automatically investigate the incident across both Microsoft Sentinel and Microsoft Defender XDR
• Correlate incident-related users, devices, files, alerts, and activities
• Enrich the investigation with Microsoft Purview risk and DLP signals
• Distinguish between confirmed indicators, suspicious signals, benign activity, and inconclusive findings
• Deliver a clear, investigation-ready summary with confidence level, supporting evidence, gaps, and recommended next steps

Typical use cases include

• Investigating possible data exfiltration incidents
• Assessing whether suspicious user activity led to sensitive data exposure
• Triaging DLP-related incidents with cross-platform context
• Supporting analysts during data security incident response and validation

Estimated Security Compute Unit (SCU) consumption:

• Small environments: ~1.2 SCUs per investigation
• Medium environments: ~1.8 to 2.5 SCUs per investigation
• Enterprise environments: ~2.8 to 4.5 SCUs per investigation

These estimates assume the agent is enriching incidents across Sentinel, Defender XDR, and Purview, and that environments with more entities, alerts, and historical activity will naturally require more compute.