Verified scope
Search is restricted to the linked account's verified primary email. Domain and phone searches are not supported.
LeakData for Microsoft security operations
Verified exposure context for analyst review
LeakData Exposure Triage is a read-only investigation agent that combines a minimized LeakData search for the linked account's verified primary email with matching LeakData delivery telemetry in the selected Microsoft Sentinel workspace.
Release status: Submission preparation
The offer is not publicly listed or certified yet. The Security Store link opens the store, not an approved LeakData listing.
Read-onlyNo automated response actions
Verified emailVerified primary email only
1-168 hoursBounded telemetry lookback
A conservative investigation path
Two sources, one evidence-aware report
The agent checks one authorized LeakData result and the selected workspace's LeakData-originated events. It explains agreement and gaps without treating duplicated delivery records as independent compromise evidence.
Minimized evidence
The report uses an exposure summary and limited Sentinel metadata instead of raw leak rows or unrelated personal data.
Human-reviewed outcome
Recommendations remain read-only and require an analyst to review independent evidence before any response action.
Agent workflow
From verified asset to a bounded triage summary
Every stage is explicit, scope-limited, and designed to stop safely when an input or permission is invalid.
Validate the scope
Accept only email, the linked account's verified primary email, and a whole-number lookback from 1 through 168 hours.
Search LeakData once
Retrieve one minimized exposure summary for the verified primary email. If the search is denied or fails, stop before querying Sentinel.
Check the selected workspace
Look for LeakDataAlerts_CL and summarize exact matching delivery events without querying another tenant.
Explain confidence and gaps
Return scope, exposure summary, workspace evidence, data-correlation confidence, and analyst-reviewed next steps.
Interpretation
Correlation confidence is not compromise confidence
The label describes agreement between the current LeakData result and LeakData delivery records in Sentinel. It does not prove account, endpoint, mailbox, domain, or tenant compromise.
High
The current authorized result and an exact matching workspace delivery agree. Analyst review is still required.
Medium
Only one source contains evidence, or the records are stale, partial, delayed, or mismatched.
None
Neither checked source contains evidence in the validated scope and time window; this is not a universal absence claim.
Critical means Severity 9 only
The native LeakData analytic rule alerts only when Severity equals 9. Lower values are not labeled critical, and the agent does not create an incident.
Before preview testing
Use an authorized workspace and an approved budget
Security Copilot capacity and Sentinel ingestion can create Azure charges. Activate them only in an explicitly approved test environment.
LeakData account
A linked LeakData account with its primary email verified.
Security Copilot access
An authorized Security Copilot workspace and permission to install or run the preview agent.
Sentinel workspace
Read access to the selected workspace and LeakDataAlerts_CL when delivery correlation is expected.
Cost and test approval
An approved capacity, ingestion, retention, synthetic-data, and preview-testing plan.
Security boundary
Designed to minimize sensitive handling
The agent combines instruction-level controls with LeakData's verified-ownership enforcement.
What it can do
- Search the linked account's verified primary email once per run
- Summarize bounded LeakData and Sentinel metadata
- State missing, stale, partial, or conflicting evidence
- Recommend read-only next steps for analyst review
What it cannot do
- Accept or reveal plaintext passwords or complete hashes
- Return raw leak rows or unrelated personal data
- Search domains, phone numbers, another tenant, or another account's email
- Delete, reset, block, isolate, notify, purchase, or create an incident
Private preview preparation
Evaluate with synthetic data before public submission
Preview access will be offered only after the remaining account, capacity, functional-test, webhook, and certification prerequisites are complete.