Cybercrime fighters struggle to uncover hidden threat intelligence quickly within large volumes of data such as legal discovery responses and documents from hosting providers. Valuable threat indicators are often buried and difficult to find, which slows down forensic investigations and makes it harder to communicate risks to defenders and customers. Solution Microsoft’s DCU developed an AI-powered tool to address these challenges. Haystack is an AI application that automatically tags likely threat intelligence indicators and uses an Azure OpenAI-based chatbot to curate intelligence rapidly. This enables analysts to identify relevant information within seconds or minutes rather than hours.
Impact / Outcome
The solution significantly accelerated the identification and curation of threat intelligence, reducing forensic investigation times from hours to minutes. Moreover, it
enabled clearer communication of complex threat data to both internal defenders at the DCU and customers, turning intelligence into actionable insights
Key Metrics
The solution significantly accelerated the identification and curation of threat intelligence, reducing forensic investigation times from hours to minutes.
Year published
04 May 2026 
Microsoft