Lesson 4 — Prompting Fundamentals for Security Analysts
Microsoft Security Copilot responds to the instructions, context and sources provided by the analyst.
A useful security prompt normally includes four elements: a clear goal, enough investigation context, the source or data to use and expectations for the final response.
This lesson explains how to turn vague questions into structured prompts that support incident triage, evidence review, threat hunting, KQL development and security reporting.
What you will learn
This lesson introduces the four elements of an effective Security Copilot prompt and the habits used to refine investigation questions.
Effective security prompt model
↓
Add the context needed to understand the task
↓
Identify the source, incident, user, device, indicator or data set
↓
Describe the expected format, depth and evidence requirements
↓
Submit the prompt
↓
Review the process log and response
↓
Ask focused follow-up questions
↓
Validate the result against source evidence
↓
Record confirmed facts, uncertainty and next actions
The four elements of an effective prompt
| Element | Purpose | Security example |
|---|---|---|
| Goal | State the task that Security Copilot should perform. | Summarise the incident and identify the likely initial access method. |
| Context | Explain why the task matters and what the analyst is investigating. | The incident involves a suspicious email, risky sign-in and PowerShell activity. |
| Source | Specify the data, incident, file, entity, plugin or product to use. | Use Microsoft Defender XDR incident 2147 and its related alerts and entities. |
| Expectations | Define the desired structure, length, audience and evidence requirements. | Return a timeline, separate fact from inference and list three next steps. |
Learning objectives
- Identify the four core prompt elements.
- Write clear security goals.
- Add useful investigation context.
- Specify relevant sources.
- Set expectations for the response.
- Use follow-up prompts.
- Recognise weak prompting patterns.
What is a prompt?
A prompt is the instruction or question supplied to Security Copilot in natural language.
Prompts are investigation instructions
They tell Copilot what task to perform, what evidence to use and how the result should be presented.
Start with the goal
The goal describes the action required, such as summarise, explain, compare, investigate, generate or validate.
Use a strong action verb
Begin with an instruction that makes the desired task clear.
Weak goal
“Tell me about this incident” does not define the required depth, focus or output.
Stronger goal
“Summarise this incident and identify the likely initial access method” gives the response a clear purpose.
Add investigation context
Context explains the situation, audience, urgency and known facts that affect the task.
Context narrows interpretation
Without context, Copilot may interpret the request too broadly or focus on the wrong part of the incident.
Include known facts
Provide confirmed information such as affected users, devices, time ranges, alerts and business services.
Do not present assumptions as facts
Clearly label suspected phishing, compromise or malware activity as unconfirmed when evidence is still being reviewed.
Identify the source
The source tells Security Copilot which incident, product, file, user, device, indicator or data set should ground the response.
Use precise entities
Include an incident number, username, device name, IP address, domain, hash or time range where appropriate.
Reference the active product context
In embedded experiences, the current incident or alert may already provide context, but the analyst should still confirm the intended scope.
Use uploaded files carefully
When files are available, name the file and describe exactly what information should be extracted or analysed.
Set expectations
Expectations define how the response should be structured and what it must include.
Specify the audience
A technical SOC summary requires different language from an executive incident update.
Specify the format
Ask for a table, timeline, bullet list, KQL query, investigation plan or concise summary.
Specify the depth
Ask for a short triage summary or a detailed evidence review depending on the investigation stage.
Request evidence
Ask Copilot to identify the alerts, entities, sources or events that support each conclusion.
Request uncertainty
Ask Copilot to highlight missing data, conflicting evidence and unsupported assumptions.
Request next steps
Ask for specific investigation pivots rather than a generic recommendation to investigate further.
Keep prompts focused
A prompt should have a clear purpose rather than combining every possible investigation question into one request.
Break complex work into stages
Start with a summary, then investigate identity, endpoint, email or cloud evidence through follow-up prompts.
Use iterative prompting
Security Copilot sessions support a conversation where each prompt can refine the previous response.
First prompt: orient
Ask for a concise overview of the incident, entities and likely sequence.
Second prompt: validate
Ask for supporting evidence, sources and anything that cannot be confirmed.
Third prompt: deepen
Explore one specific hypothesis, entity or stage of the attack.
Fourth prompt: act
Request investigation priorities, containment considerations or reporting output based on verified findings.
Use positive instructions
Tell Copilot what to include and how to organise the response rather than relying only on prohibitions.
Use constraints carefully
Specify time ranges, entity types, source products and output length where they improve relevance.
Avoid excessive constraints
Too many conflicting instructions can make the prompt harder to follow and reduce the usefulness of the answer.
Use security terminology
Include precise terms such as initial access, persistence, lateral movement, privilege escalation or exfiltration when they match the task.
Define ambiguous terms
Words such as suspicious, critical or unusual should be supported by context or an investigation criterion.
Ask for chronological order
For attack-path analysis, explicitly request a timeline sorted by timestamp.
Ask for entity correlation
Request relationships between users, devices, IP addresses, mailboxes, applications and cloud resources.
Ask for confirmed versus inferred
Require separate sections for confirmed evidence, likely interpretation and unresolved questions.
Ask for confidence
Request a confidence level and the evidence that justifies it.
Ask for limitations
Request a list of data sources or permissions that may be missing from the current response.
Use role context carefully
You can ask for an answer suitable for a Tier 1 analyst, incident responder or executive audience, but role wording does not replace evidence.
Do not ask Copilot to decide guilt
Ask it to analyse behaviours and evidence rather than declaring that a user or administrator acted maliciously.
Protect sensitive information
Include only the information required for the task and follow organisational policies for personal, confidential and regulated data.
Review before sending
Check the prompt for incorrect incident numbers, misspelled entities, excessive scope and accidental exposure of sensitive data.
Review the process log
After submitting, inspect the selected capability, actions and sources used to produce the answer.
Validate the response
A well-written prompt improves the result, but it does not guarantee that the response is correct.
Weak prompt versus effective prompt
| Weak prompt | Why it is weak | Improved prompt |
|---|---|---|
| What happened? | No incident, source, time range, audience or expected output. | Summarise Microsoft Defender XDR incident 2147 for a SOC analyst. Identify the likely initial access method, affected users and devices, key evidence, uncertainty and the next three investigation steps. |
| Write KQL for phishing. | The required table, indicator, time range and output are undefined. | Generate a Microsoft Defender XDR advanced hunting query using EmailEvents to find messages from contoso-example.com delivered during the last seven days. Return Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, DeliveryAction and NetworkMessageId. |
| Is this user compromised? | Requests a verdict without defining evidence or confidence. | Review the available sign-in, identity and incident evidence for user alexw@contoso.com. Separate confirmed suspicious activity from legitimate explanations, identify missing evidence and provide a confidence assessment. |
| Make an executive report. | No source, audience need, length or verified findings. | Create a 200-word executive incident update based only on the verified findings in this session. Include business impact, actions completed, remaining risk and decisions required. Do not include unsupported technical conclusions. |
Example structured investigation prompt
Summarise Microsoft Defender XDR incident 2147 and identify the likely attack path.
Context:
The incident includes a suspicious email, a risky Entra sign-in and PowerShell activity on one endpoint.
The summary will be used by a Tier 2 incident responder.
Source:
Use the incident, related alerts, entities and available Defender XDR evidence.
Expectations:
1. Produce a chronological timeline.
2. Identify affected users and devices.
3. Separate confirmed facts from inference.
4. Cite the evidence supporting each major conclusion.
5. Highlight missing or conflicting data.
6. Recommend the next three investigation steps.
Agent Foskett investigation: “The prompt blamed the administrator…”
↓
The first prompt asked:
“Explain how the administrator used PowerShell to compromise the server.”
↓
The prompt already assumed compromise and malicious intent
↓
Security Copilot produced a convincing attack explanation
↓
Agent Foskett reviewed the source evidence
↓
The command had been run during an approved maintenance window
↓
The administrator account and device were legitimate
↓
The first prompt had steered the response toward the wrong conclusion
↓
Agent Foskett rewrote the prompt:
“Analyse this PowerShell activity and compare malicious and legitimate explanations.”
↓
The new response identified maintenance activity as a plausible explanation
↓
Change records and endpoint telemetry confirmed the event
↓
The alert remained useful
↓
But the evidence did not support administrator compromise
↓
The investigation question changed the direction of the answer
Prompt review checklist
| Check | Question | Why it matters |
|---|---|---|
| Goal | Is the required task clear? | Copilot needs a defined action. |
| Context | Does the prompt explain the investigation situation? | Context reduces ambiguity. |
| Source | Is the incident, product, entity or file identified? | The response needs grounded data. |
| Expectations | Is the desired structure and depth stated? | The output should match the analyst's need. |
| Scope | Are time range and entities controlled? | Over-broad scope creates noise. |
| Neutrality | Does the prompt avoid assuming the conclusion? | Leading prompts can bias the response. |
| Evidence | Does the prompt request supporting sources? | Conclusions must be traceable. |
| Uncertainty | Does it request gaps and conflicting evidence? | Unknowns must remain visible. |
| Audience | Is the response intended for analysts or executives? | Language and detail should be appropriate. |
| Sensitivity | Does the prompt include only necessary information? | Security data must be handled responsibly. |
Key takeaways
- An effective Security Copilot prompt normally includes a goal, context, source and expectations.
- The goal defines what task Security Copilot should perform.
- Context explains the investigation situation and intended use.
- The source identifies the incident, product, file, entity or data that should ground the response.
- Expectations define the output structure, depth, audience and evidence requirements.
- Complex investigations should be broken into focused, iterative prompts.
- Prompts should request supporting evidence, uncertainty and specific next steps.
- Leading prompts can steer the response toward an unsupported conclusion.
- Sensitive information should be limited to what the task requires.
- Even an excellent prompt still requires analyst validation.
What Agent Foskett checked
- Investigation goal
- Known context
- Named sources
- Expected format
- Time range
- Entity scope
- Leading assumptions
- Evidence request
- Uncertainty request
- Audience
Best practices
- Use clear action verbs.
- Provide useful context.
- Name the source.
- Define the expected output.
- Keep prompts focused.
- Use iterative follow-ups.
- Request evidence.
- Ask for uncertainty.
- Avoid leading conclusions.
- Validate every response.
Related Agent Foskett resources
Continue the Microsoft Security Copilot Academy
How do you write effective Microsoft Security Copilot prompts?
Effective Microsoft Security Copilot prompts include a clear goal, useful context, a relevant source and expectations for the response structure, audience, evidence and depth.
Security Copilot prompt examples
Security analysts can prompt Security Copilot to summarise incidents, identify attack paths, explain alerts, generate KQL, correlate entities, create timelines and draft reports while requesting supporting evidence and uncertainty.
Prompting fundamentals for security analysts
Security prompting should remain focused, neutral and evidence-driven. Analysts should avoid leading conclusions, use iterative follow-ups and validate every response against the underlying security data.
