Lesson 38 — Advanced Prompt Engineering
Good prompting is not about finding a magic sentence. It is about turning an investigation into a precise, testable set of questions.
Advanced Security Copilot prompting combines context, decomposition, constraints, structured outputs, iterative refinement and evidence validation.
This lesson moves from broad requests to repeatable analyst prompts that expose assumptions, identify missing evidence and make important conclusions easier to verify.
What you will learn
Build precise, structured and evidence-driven Security Copilot prompts.
The advanced prompting cycle
↓
Set entity and time scope
↓
Provide relevant evidence and context
↓
State constraints and required output
↓
Run the first prompt
↓
Validate claims against source evidence
↓
Identify gaps and contradictions
↓
Refine the next question
↓
Test alternative explanations
↓
Build the final evidence-backed conclusion
Anatomy of an advanced prompt
| Component | Purpose | Example |
|---|---|---|
| Role | Sets perspective | SOC analyst reviewing identity compromise. |
| Objective | Defines the question | Determine whether evidence supports compromise. |
| Scope | Limits investigation | User, device and 02:00–04:00 UTC. |
| Evidence | Defines sources | Use supplied sign-in and consent events. |
| Constraints | Controls inference | Do not infer malicious intent without evidence. |
| Output | Makes review easier | Timeline, findings, gaps and next actions. |
Learning objectives
Use decomposition, iterative prompting, structured outputs, role context, constraints and evidence-driven refinement to produce precise and testable Security Copilot results.
Advanced prompting is controlled investigation
The goal is not a clever prompt. The goal is a security question precise enough that every important claim can be checked.
Start with the objective
State exactly what you are trying to determine before deciding how the response should look.
Define role context
Tell Copilot whether the task is triage, hunting, incident investigation, query review, handover or executive reporting.
Define the scope
Specify relevant users, devices, IP addresses, applications, resources and time ranges.
Provide only relevant context
Enough context improves reasoning; unnecessary context creates distraction and can expose sensitive information.
Name the evidence sources
Identify whether the supplied evidence comes from Defender XDR, Sentinel, Entra, email telemetry or another source.
Use explicit constraints
Tell Copilot what it must not assume and where it should stop if evidence is missing.
Require evidence-backed claims
Ask for confirmed observations to be separated from interpretation.
Preserve uncertainty
Require unresolved questions and unsupported claims to remain visible.
Ask for missing evidence
A useful response should explain what additional telemetry would strengthen or reject the current hypothesis.
Use decomposition
Break complex incidents into smaller questions that can each be validated.
Identity decomposition
Review sign-ins, MFA, application consent, privilege changes and session activity separately before correlation.
Endpoint decomposition
Review process ancestry, commands, files, network connections and persistence separately.
Email decomposition
Review authentication, delivery path, URLs, attachments, recipients and post-delivery activity.
Cloud decomposition
Review identities, resource changes, permissions, exposure and control-plane activity.
Correlate after validation
Connect evidence across products only after the important events have been individually checked.
Use iterative prompting
Treat the first response as the start of the investigation rather than the final verdict.
Narrow broad answers
Refine the entity, time range, source or expected output when a response is too general.
Challenge the working theory
Ask what evidence would contradict the current interpretation.
Request benign alternatives
Unusual behaviour can result from administration, automation, travel, VPNs or legitimate user activity.
Ask what does not fit
Conflicting evidence can be more valuable than another fact that confirms the first theory.
Use structured outputs
Timelines, tables and evidence matrices make responses easier to review.
Timeline output
Request timestamp, entity, event, source and significance.
Evidence matrix
Separate observation, source evidence, interpretation and confidence.
Confirmed versus unconfirmed
Prevent assumptions from blending into established facts.
Control response length
Use concise outputs for triage and deeper outputs for complex investigation.
Control audience
Specify whether the output is for an analyst, engineer, manager or executive.
Separate audiences
Technical evidence and executive reporting should normally be produced as separate outputs.
Use neutral wording
Ask whether evidence supports compromise rather than instructing Copilot to explain how compromise occurred.
Avoid leading prompts
Prompts that contain the desired verdict create confirmation bias.
Avoid vague prompts
'Investigate this user' lacks scope, evidence requirements and an expected output.
Avoid overloaded prompts
Split large workflows into scope, collection, correlation, hypothesis testing and reporting.
Validate identifiers
Check domains, IPs, hashes, usernames, processes and timestamps against source telemetry.
Validate generated KQL
Confirm tables, fields, syntax, joins, filters, logic and returned results.
Ask Copilot to explain KQL
Analysts should understand generated queries before relying on them.
Refine KQL incrementally
Validate a simple query before adding parsing, joins and correlations.
Use delimiters
Clearly separate instructions from pasted logs, evidence and case notes.
Label evidence blocks
Make the origin of each evidence block obvious.
Prompt for comparison
Compare users, devices, time periods or event sets using explicit criteria.
Prompt for baselines
Define normal behaviour before deciding whether an event is anomalous.
Prompt for sequence
Ask for chronological ordering where attack progression matters.
Do not confuse sequence with causality
One event occurring before another does not prove it caused the next event.
Ask for confidence with reasons
Confidence should be tied to supporting and missing evidence rather than an unexplained percentage.
Ask for contradictions
A strong prompt actively searches for evidence that weakens the current conclusion.
Ask for attack-path thinking
Where relevant, connect identity, endpoint, email and cloud evidence without inventing missing stages.
Map MITRE after evidence
ATT&CK labels should describe established behaviour rather than substitute for evidence.
Prompt for handovers
Request status, confirmed evidence, unresolved questions, completed actions, owner and next steps.
Prompt for executive summaries
Request business impact, response status and remaining risk without unnecessary technical detail.
Prompt for peer review
Ask Copilot to identify unsupported claims, missing evidence and ambiguous wording.
Prompt for hypotheses
Generate possibilities to investigate, not conclusions to accept.
Prompt for hunting pivots
Ask for relevant entities, behaviours and telemetry sources that can test a hypothesis.
Prompt for query critique
Ask for logical gaps, assumptions and inefficient operations in KQL.
Build reusable patterns
Repeatable structures improve consistency across analysts and shifts.
Use variables
Promptbooks should use placeholders for user, device, incident, time range and other case-specific inputs.
Document required inputs
Operational prompts should state what evidence must be available before use.
Document expected outputs
Analysts should know what a prompt produces and what it is not authorised to decide.
Version operational prompts
Important promptbooks should be reviewed and tracked like other SOC procedures.
Test known cases
Use validated historical or synthetic cases to test whether prompts surface the important evidence.
Test failure cases
Include incomplete, conflicting and benign scenarios rather than only obvious compromises.
Measure prompt quality
Evaluate time, consistency, evidence coverage and decision quality—not prompt length or prompt count.
Protect sensitive information
Advanced prompting still follows the minimum-necessary-data principle from Lesson 37.
Respect access control
Prompt engineering cannot grant access to data the analyst is not authorised to see.
Know when to stop prompting
If the answer depends on missing telemetry, collect the telemetry rather than endlessly rephrasing the question.
Return to source tools
Defender, Sentinel, Entra, Purview and other security products remain where evidence is validated.
Preserve human judgement
A sophisticated prompt does not transfer accountability from the analyst to Copilot.
Final prompting principle
The best advanced prompt makes the investigation easier to verify, not harder to question.
From weak prompt to investigation prompt
Agent Foskett investigation: “The prompt already knew the answer”
↓
He prompted: “Explain how this attacker compromised the account.”
↓
Copilot produced a convincing attack narrative
↓
Impossible travel
↓
MFA manipulation
↓
Session abuse
↓
Agent Foskett checked the source events
↓
The supposed impossible travel involved the approved corporate VPN
↓
No MFA method had changed
↓
No evidence showed session theft
↓
The prompt had started with the conclusion
↓
It was rewritten:
“Does the supplied evidence support account compromise?”
↓
Copilot was required to list supporting evidence
↓
Contradictory evidence
↓
And missing telemetry
↓
The result changed completely
↓
The activity was unusual
↓
But compromise remained unproven
Advanced prompt checklist
| Question | Good practice |
|---|---|
| What am I determining? | State one clear security objective. |
| What is the scope? | Define entities and time range. |
| What evidence may be used? | Name the supplied sources. |
| What must not be assumed? | Add explicit constraints. |
| How should the answer look? | Request a timeline, table or schema. |
| How is uncertainty shown? | Separate confirmed and unconfirmed findings. |
| What contradicts the theory? | Request alternative explanations. |
| What is missing? | Ask for additional telemetry. |
| How will I validate it? | Return to source evidence. |
Key takeaways
- Begin with a precise security objective.
- Define entities, evidence and time range.
- Decompose complex investigations.
- Use iterative prompting rather than expecting one perfect answer.
- Request structured, reviewable outputs.
- Separate evidence, interpretation and uncertainty.
- Ask for contradictions and benign alternatives.
- Never embed the desired verdict in the prompt.
- Validate KQL and technical identifiers.
- Use reusable patterns with defined inputs and outputs.
- Prompt length and volume are not quality measures.
- The final conclusion remains the analyst's responsibility.
Related Agent Foskett resources
Continue Module 4 — Operational Security Copilot
Advanced prompt engineering for Microsoft Security Copilot
Advanced Security Copilot prompting uses clear objectives, investigation scope, relevant context, decomposition, explicit constraints, structured outputs, iterative refinement and evidence validation.
