Skip to main content
Question

Copilot user promt and response monitor

  • June 24, 2026
  • 4 replies
  • 70 views

Austin123
Forum|alt.badge.img+4

Hi Team,

Could you please suggest the best approach to integrate Microsoft Copilot logs with Google SecOps.

Our objective is to monitor and analyze user interactions with Copilot, including:

  • User prompts submitted to Copilot
  • Copilot responses generated for users

4 replies

Austin123
Forum|alt.badge.img+4
  • Author
  • Bronze 3
  • June 25, 2026

Hi Team, 

Any update on this.


kentphelps
Community Manager
Forum|alt.badge.img+12
  • Community Manager
  • July 7, 2026

@Austin123 
There was a new log type rolled out last week for Microsoft Copilot Interaction (check SIEM Settings > Available Log Types if you want to confirm your instance has been updated).

You can use the docs at CopilotInteraction for addtional info.


Austin123
Forum|alt.badge.img+4
  • Author
  • Bronze 3
  • July 8, 2026

Hi ​@kentphelps ,

Thanks for your response.

I checked and found that we have the Microsoft Copilot Interaction log type available under SIEM Settings > Available Log Types .

Could you please advise whether it is possible to collect the full Copilot prompts? If so, could you share the relevant documentation or reference for configuring this?

Note: We have already integrated the OFFICE365 log type and are receiving Copilot-related metadata, including the target application. However, we are not receiving the complete user prompts.

 


kentphelps
Community Manager
Forum|alt.badge.img+12
  • Community Manager
  • July 10, 2026

Without a parser these logs will get ingested but not mapped to UDM.  But you should still find them via a raw log search.  Is that not the case?