How to read it. Each row is one specialist agent use case, grouped by the specialist families in the fleet visual (identity, endpoint, network, cloud and audit, plus cross-cutting). Each column is a data source the agent reads.
The blue columns on the left are the seven normalized schemas: ASIM functions in the Sentinel analytics tier, or normalized tables in the data lake, reached by the agent through custom Sentinel MCP tools (saved KQL). The navy columns on the right are Security Copilot plugin sources, which already return a common shape for each Microsoft product.
A solid dot means the agent's main question is answered from that source. A ring means the source adds context. The bottom row counts how many agents read each source: that count is the reuse normalization buys, since one parser or plugin serves all of them. A lime tag marks a use case Microsoft already ships as a Security Copilot agent.
Click a column to highlight the agents that depend on it. Click a row for the trigger, tools and actions.
Notes
Plugin columns list the Microsoft plugins Security Copilot documents: Microsoft Entra, Defender XDR, Intune, Purview, Defender Threat Intelligence and Defender External Attack Surface Management. Microsoft Sentinel reaches Security Copilot through its own plugin and through the Sentinel MCP server; in this matrix it is the route to the normalized schemas rather than a column of its own.
A use case marked as a Microsoft agent means a built-in agent covers similar ground. It is still useful to build your own version when you need it to read your non-Microsoft sources through the normalized schemas, which the built-in agents may not.
The mapping is a starting design, not a product capability list. Check each source's licensing and roles before you build: plugins need the product licensed in the tenant, and some, such as Sentinel and Intune, need a product role in addition to Security Copilot access.