Lesson 6 — Understanding Security Copilot Promptbooks
Promptbooks are reusable sequences of prompts designed to complete a specific security task.
Instead of asking the same investigation questions manually each time, analysts can run a promptbook that guides Security Copilot through a repeatable workflow.
This lesson explains how promptbooks are structured, how later prompts build on earlier responses, what inputs and plugins they require and why every step still needs analyst validation.
What you will learn
This lesson introduces promptbook structure, execution, inputs, plugins, visibility, validation and operational use.
Promptbook workflow model
↓
Required inputs are supplied
↓
Required plugins and permissions are checked
↓
Prompt 1 runs
↓
Response 1 becomes context for Prompt 2
↓
Prompt 2 runs
↓
Additional prompts continue in sequence
↓
Each step contributes to the final result
↓
The analyst reviews process logs, sources and failures
↓
Important findings are validated against the original evidence
↓
The promptbook output is approved, refined or rejected
Promptbook components
| Component | Purpose | Analyst responsibility |
|---|---|---|
| Goal | Defines the security task the promptbook is designed to complete. | Confirm the workflow matches the current investigation. |
| Input | Provides the incident, user, device, indicator, code or other starting value. | Supply accurate and appropriately scoped information. |
| Prompt sequence | Runs one or more prompts in a defined order. | Review whether each step is logically necessary. |
| Plugins | Provide the required security data or capability. | Confirm plugins are enabled and permissions are available. |
| Visibility | Controls who can discover and use the promptbook. | Share only approved workflows with suitable users. |
| Failure behaviour | Determines whether later steps stop or continue after a failure. | Understand the risk of incomplete context. |
| Final output | Combines the results produced by the sequence. | Validate evidence, uncertainty and suitability before use. |
Learning objectives
- Define a Security Copilot promptbook.
- Understand sequential prompt execution.
- Recognise required inputs and plugins.
- Use prebuilt and custom promptbooks.
- Understand visibility and ownership.
- Review continue-on-failure behaviour.
- Validate multi-step outputs.
What is a promptbook?
A promptbook is a reusable collection of one or more prompts that work together to complete a specific security task.
Promptbooks are sequential
The prompts run one after another, and later prompts can build on responses produced earlier in the workflow.
Promptbooks resemble playbooks
They can serve as repeatable workflow templates for investigations, triage, threat intelligence and reporting.
Promptbooks reduce repetition
Analysts do not need to remember and retype the same sequence of investigation questions every time.
Promptbooks improve consistency
A shared workflow can help different analysts ask the same core questions in the same order.
Promptbooks do not guarantee quality
A repeatable workflow can still contain weak prompts, incomplete scope or unsupported assumptions.
Prebuilt promptbooks
Security Copilot includes prebuilt promptbooks for supported security tasks and investigation scenarios.
Custom promptbooks
Users with suitable permissions can create promptbooks tailored to their organisation's workflows.
Organisation promptbook library
Prebuilt and user-created promptbooks can appear together in the Security Copilot promptbook library.
Promptbook metadata
The library can show name, owner, description, prompt count, required plugins and visibility.
Search and filters
Analysts can search and filter the library to find a promptbook relevant to the current task.
Start with a clear outcome
A promptbook should be designed around one defined result, such as incident triage or threat-actor research.
Use appropriate inputs
Promptbooks can require values such as an incident number, code snippet, user, device, domain or threat-actor name.
Inputs should be validated
An incorrect incident ID or misspelled entity can cause the entire sequence to use the wrong context.
Each prompt should have a purpose
Remove steps that duplicate earlier work or do not contribute to the final outcome.
Order matters
Place orientation and evidence-gathering prompts before interpretation, recommendations and reporting prompts.
Early errors can propagate
If the first response contains an incorrect assumption, later prompts may build on that weak foundation.
Use neutral early prompts
Initial steps should establish facts and scope before asking Security Copilot to explain the attack path.
Prompt 1: identify
Start by identifying the incident, entities, alerts and available evidence.
Prompt 2: organise
Arrange the evidence into a timeline or grouped set of investigation facts.
Prompt 3: analyse
Ask for likely relationships, hypotheses and attack-stage interpretation.
Prompt 4: validate
Request supporting sources, conflicting evidence and anything that cannot be confirmed.
Prompt 5: communicate
Produce the final analyst summary, handover or executive update from verified results.
Required plugins
A promptbook may depend on specific plugins to access the required data or capability.
Plugin availability matters
The workflow may fail or return incomplete results when a required plugin is disabled or unavailable.
Permissions still apply
Promptbooks do not bypass the signed-in user's product permissions or Security Copilot role assignments.
Different users can see different results
The same promptbook may produce different context when analysts have different data access.
Visibility controls discovery
Promptbook visibility determines whether it is private, shared or available to a broader approved audience.
Ownership matters
The owner should maintain the promptbook when products, plugins, terminology or workflows change.
Descriptions should be specific
State the purpose, required input, expected result and intended analyst audience.
Name promptbooks clearly
Use names such as “Phishing Incident Triage” rather than vague labels such as “Investigation Workflow.”
Test with realistic data
Validate the promptbook using representative incidents and known outcomes before publishing it widely.
Test negative cases
Run the workflow against benign or incomplete activity to see whether it overstates malicious conclusions.
Review the process log
Inspect the actions, plugins, sources and errors generated during each step.
Review every intermediate response
The final output may hide a weak assumption introduced earlier in the sequence.
Continue on failure
Promptbooks can support continuing to later prompts when an earlier prompt fails.
Failure continuation needs care
A later step may run without the context it expected from the failed prompt.
Use failure-tolerant prompts
Later prompts should state how to handle missing earlier output where continuation is enabled.
Stop when evidence is essential
Do not continue to conclusions or response recommendations when a critical evidence step has failed.
Promptbooks consume capacity
Each prompt in the sequence contributes to Security Copilot usage and should deliver clear value.
Keep workflows efficient
Remove redundant prompts and avoid asking for the same summary in multiple formats unless required.
Promptbooks and agents differ
Promptbooks follow a defined linear sequence, while agents can support more dynamic task planning and actions.
Use promptbooks for deterministic work
They suit repeatable workflows where the investigation steps should occur in a predictable order.
Use chat for exploration
Ad-hoc chat remains useful when the investigation direction is uncertain or changes rapidly.
Use agents for broader automation
Agents may be more appropriate when the workflow requires dynamic planning, triggers or configured actions.
Document assumptions
State what data, plugins, permissions and incident conditions the promptbook expects.
Version the workflow
Track changes to prompt wording, plugin dependencies and expected output.
Retire outdated promptbooks
Remove or replace workflows that rely on deprecated fields, old portals or unsupported investigation methods.
Human review remains mandatory
Promptbook outputs should support analyst decisions, not silently become security conclusions.
Example phishing triage promptbook
Microsoft Defender XDR incident ID
Prompt 1 — Identify the incident scope
List the alerts, users, devices, messages, URLs and indicators associated with the incident.
Prompt 2 — Build the timeline
Arrange the available evidence chronologically and identify missing time periods.
Prompt 3 — Analyse the email path
Summarise delivery, authentication, URL-click and attachment evidence.
Prompt 4 — Analyse identity and endpoint activity
Identify sign-ins, account changes, processes and network activity that occurred after delivery.
Prompt 5 — Validate the hypothesis
Separate confirmed facts from inference, identify conflicting evidence and list unresolved questions.
Prompt 6 — Produce the handover
Create a concise Tier 2 analyst summary with scope, evidence, confidence and next steps.
Agent Foskett investigation: “The promptbook completed successfully…”
↓
The final summary described credential theft and endpoint compromise
↓
The workflow looked consistent
↓
Agent Foskett reviewed the intermediate responses
↓
Prompt 2 had interpreted an unrelated sign-in as attacker activity
↓
Prompt 3 and Prompt 4 reused that assumption
↓
The final summary repeated the conclusion with greater confidence
↓
The promptbook had completed technically
↓
But the investigation logic had failed
↓
Agent Foskett opened the source sign-in record
↓
The activity belonged to an approved administrator
↓
The promptbook was updated to require entity validation before attack-path analysis
↓
A successful run was no longer treated as a proven result
Promptbook validation checklist
| Area | Check | Reason |
|---|---|---|
| Purpose | Does the promptbook solve one defined security task? | Broad workflows become difficult to validate. |
| Input | Are the required inputs correct and clearly described? | Bad input affects every later step. |
| Sequence | Does each prompt build logically on the previous result? | Order determines workflow quality. |
| Neutrality | Do early prompts avoid assuming compromise? | Leading assumptions can propagate. |
| Plugins | Are all required plugins enabled and authorised? | Missing data can weaken the workflow. |
| Failure | Should the promptbook stop or continue after each failure? | Later prompts may lack required context. |
| Intermediate output | Are each prompt's sources and conclusions reviewed? | The final result can hide earlier mistakes. |
| Visibility | Is the promptbook shared with the correct audience? | Workflows and data requirements may be sensitive. |
| Efficiency | Does every prompt add value? | Redundant steps consume time and capacity. |
| Final validation | Does the original evidence support the result? | Promptbook output is not a verdict. |
Key takeaways
- Promptbooks are reusable sequences of one or more prompts designed to complete a specific security task.
- Prompts run in order and later steps can build on earlier responses.
- Promptbooks can function like repeatable playbook-style workflows for investigations and response.
- Prebuilt and custom promptbooks can appear in the organisation's promptbook library.
- Promptbooks may require specific inputs, plugins and permissions.
- Early assumptions and errors can propagate through the entire sequence.
- Continue-on-failure behaviour should be used carefully when later prompts depend on missing context.
- Promptbooks are best suited to deterministic, repeatable workflows.
- Every intermediate response and final output should be validated against source evidence.
- A technically successful promptbook run does not prove the investigation conclusion.
What Agent Foskett checked
- Promptbook purpose
- Required input
- Prompt order
- Plugin dependencies
- User permissions
- Intermediate responses
- Failure behaviour
- Source evidence
- Visibility
- Final conclusion
Best practices
- Design for one outcome.
- Use clear inputs.
- Gather facts first.
- Validate entities early.
- Keep prompts in logical order.
- Document plugin requirements.
- Test failure conditions.
- Review every step.
- Remove redundant prompts.
- Validate before sharing.
Related Agent Foskett resources
Continue the Microsoft Security Copilot Academy
What are Microsoft Security Copilot promptbooks?
Microsoft Security Copilot promptbooks are reusable sequences of prompts that run in order to accomplish specific security tasks such as incident triage, investigations, threat intelligence and reporting.
How do Security Copilot promptbooks work?
Promptbooks use required inputs, enabled plugins and user permissions, with later prompts building on earlier responses. Analysts should review process logs, intermediate outputs, failures and final evidence.
Security Copilot promptbook best practices
Effective promptbooks have one clear outcome, validated inputs, logical prompt order, documented plugin requirements, tested failure handling and mandatory analyst validation.
