Lesson 5 — Writing Better Security Prompts
Prompting fundamentals explain the parts of a good prompt. Writing better security prompts is about refining those parts so the response is focused, neutral, evidence-driven and useful to the investigation.
This lesson develops practical prompt patterns for incidents, identity, email, endpoints, cloud, threat intelligence, KQL and executive reporting.
The objective is not to create one perfect question. It is to build a repeatable conversation that moves from orientation to validation, deeper investigation and action.
What you will learn
This lesson turns prompt structure into practical investigation techniques.
Prompt refinement workflow
↓
Limit the scope to the relevant incident, entities and time range
↓
Use neutral language that does not assume the conclusion
↓
Specify sources and required evidence
↓
Define the output structure and audience
↓
Submit the prompt
↓
Review sources, process log and uncertainty
↓
Ask one focused follow-up question
↓
Repeat until the evidence supports a decision
From vague to investigation-ready
| Vague prompt | Improved prompt | Improvement |
|---|---|---|
| Investigate this incident. | Summarise Defender XDR incident 2147 for a Tier 2 analyst. Produce a timeline, affected entities, confirmed evidence, uncertainty and the next three investigation steps. | Adds source, audience, format and evidence requirements. |
| Was the user hacked? | Review the available identity evidence for alexw@contoso.com between 08:00 and 12:00 UTC. Compare compromise and legitimate explanations and identify missing evidence. | Uses neutral wording and a controlled time range. |
| Write phishing KQL. | Generate a Defender XDR EmailEvents query for messages from contoso-example.com during the last seven days. Return Timestamp, sender, recipient, subject, delivery action and NetworkMessageId. Explain schema assumptions. | Defines environment, table, filter and output. |
Learning objectives
- Refine vague prompts.
- Control investigation scope.
- Use neutral hypotheses.
- Request structured evidence.
- Develop reusable prompt patterns.
- Improve KQL prompts.
- Use iterative follow-ups.
Better prompts begin with a precise task
Replace broad requests with a specific action such as compare, correlate, validate, explain, generate, summarise or prioritise.
Control the scope
Define the incident, entity, time range, product and evidence type so the response does not drift into unrelated activity.
Use one investigation objective at a time
Separate triage, root-cause analysis, containment planning and executive reporting into different prompts.
Avoid writing the answer into the question
Do not assume phishing, compromise or malicious intent before the evidence supports it.
Use neutral hypothesis language
Ask Copilot to compare malicious and legitimate explanations and identify which evidence supports each possibility.
State known facts separately
List confirmed information before suspected activity so facts and assumptions are not mixed together.
Define the evidence threshold
Ask what evidence would be required to confirm or reject the hypothesis.
Request supporting sources
Require alert names, timestamps, entities, tables, plugins or direct source links for major conclusions.
Request conflicting evidence
Ask Copilot to identify events that do not fit the proposed attack path.
Request missing evidence
Ask what data, permissions or telemetry would be needed for a stronger conclusion.
Use chronological output
Request a timestamped timeline when sequence and causality matter.
Use structured sections
Specify headings such as confirmed facts, inference, affected entities, uncertainty and next steps.
Use tables for comparison
Tables work well for users, devices, indicators, hypotheses, controls and evidence strength.
Control response length
Ask for a short triage summary, detailed technical analysis or fixed-length executive update.
Define the audience
State whether the answer is for a Tier 1 analyst, incident responder, manager or executive.
Ask for confidence with reasons
Request confidence as confirmed, high, medium or low and require an explanation of the supporting evidence.
Ask for actionable next steps
Request a small number of prioritised investigation actions tied to unresolved evidence.
Use investigation stages
Orient, validate, deepen and act through separate prompts rather than one oversized request.
Orient the session
Begin with a concise summary of the incident, key entities and likely sequence.
Validate the first answer
Follow with a request for sources, uncertainty and unsupported assumptions.
Deepen one branch
Investigate one identity, endpoint, email, cloud resource or indicator at a time.
Convert findings into action
Only request containment or reporting after the important facts have been reviewed.
Use follow-up prompts instead of repetition
Build on the current session when the scope remains the same.
Restate scope when it changes
Name the new incident, entity or time range so inherited session context does not cause confusion.
Ask Copilot to improve your prompt
You can provide a draft prompt and ask Security Copilot to make it clearer without changing the investigation objective.
Use prompt templates
Reusable patterns improve consistency while allowing incident-specific entities and time ranges to be inserted.
Incident-summary pattern
Request timeline, affected assets, initial access, evidence, uncertainty and next steps.
Identity-investigation pattern
Request sign-in sequence, authentication details, risk events, privilege changes, device context and legitimate explanations.
Email-investigation pattern
Request sender authentication, delivery path, recipients, URL clicks, attachments and post-delivery actions.
Endpoint-investigation pattern
Request process tree, command line, files, persistence, network connections and related alerts.
Cloud-investigation pattern
Request affected resources, identities, permissions, exposure, attack paths and workload evidence.
Threat-intelligence pattern
Request indicator reputation, campaign context, ATT&CK techniques, confidence and relevance to internal evidence.
KQL prompt: name the environment
Specify Microsoft Defender XDR advanced hunting, Microsoft Sentinel or Log Analytics because tables and schemas differ.
KQL prompt: name the table
Identify EmailEvents, DeviceProcessEvents, SigninLogs or another required source when known.
KQL prompt: define the time range
Include the investigation window to reduce cost, noise and irrelevant results.
KQL prompt: define output columns
Request the exact fields required for investigation and reporting.
KQL prompt: request comments
Ask for comments explaining each stage of a generated query.
KQL prompt: request schema warnings
Ask Copilot to identify assumptions about tables or columns that must be verified.
KQL prompt: validate before use
Generated queries must be tested, reviewed and adjusted against the actual tenant schema.
MITRE ATT&CK prompts
Ask for mapping only when observed behaviours support the technique and request the evidence for each mapping.
Executive-summary prompts
Use verified findings only and request business impact, actions completed, remaining risk and decisions required.
Avoid vague adjectives
Replace unusual, critical or suspicious with measurable criteria or observed behaviours.
Avoid unnecessary jargon
Use terminology that adds precision rather than making the prompt harder to interpret.
Avoid conflicting instructions
Do not ask for exhaustive detail and a two-sentence answer in the same prompt.
Avoid excessive entity lists
Break large indicator sets into manageable groups or use files and structured sources where supported.
Protect sensitive information
Include only the personal, confidential or regulated information needed for the investigation.
Review the prompt before sending
Check entity names, time ranges, tenant context, intended source and output expectations.
Review the response after generation
Inspect the process log, source links, evidence quality and limitations before using the answer.
Reusable incident prompt pattern
Summarise and assess incident [INCIDENT ID].
Context:
This is a [TRIAGE / TIER 2 / EXECUTIVE] review involving [KNOWN FACTS].
Source:
Use [PRODUCT], related alerts, entities and available evidence between [START] and [END].
Expectations:
1. Build a chronological timeline.
2. Identify affected users, devices and resources.
3. Separate confirmed facts from inference.
4. Cite evidence for major conclusions.
5. Identify missing or conflicting data.
6. Recommend the next three investigation steps.
Reusable KQL prompt pattern
Objective:
Find [BEHAVIOUR OR INDICATOR].
Source:
Use [TABLE OR TABLES] between [START] and [END].
Filters:
[USERS / DEVICES / DOMAINS / IPS / HASHES].
Output:
Return [REQUIRED COLUMNS], sorted by Timestamp descending.
Validation:
Add comments, identify schema assumptions and explain how to test the result.
Agent Foskett investigation: “The perfect prompt proved the wrong attack…”
↓
The analyst asked Copilot to prove that phishing caused the compromise
↓
The response linked the email, sign-in and mailbox rule
↓
The story looked complete
↓
Agent Foskett checked the timestamps
↓
The mailbox rule existed before the phishing message arrived
↓
The first prompt had requested proof instead of analysis
↓
He rewrote the prompt to compare competing explanations
↓
Copilot identified an older delegated application as another possibility
↓
Audit evidence confirmed the rule had been created by an approved automation account
↓
The risky sign-in still required investigation
↓
But the mailbox rule was not persistence
↓
A polished prompt had produced a polished but incorrect story
↓
Neutral prompting and timeline validation corrected the case
Prompt quality checklist
| Area | Question | Good result |
|---|---|---|
| Task | Is the action precise? | One clear investigation objective. |
| Scope | Are incident, entities and time range defined? | Relevant evidence without unnecessary noise. |
| Neutrality | Does the prompt avoid assuming guilt or compromise? | Competing explanations remain possible. |
| Source | Is the product, table, file or incident named? | Grounded context can be traced. |
| Output | Is the format and audience defined? | The response is usable for the intended workflow. |
| Evidence | Are supporting sources requested? | Major claims can be checked. |
| Uncertainty | Are gaps and conflicts requested? | Unknowns stay visible. |
| Follow-up | Is the next question focused? | The investigation deepens without scope drift. |
Key takeaways
- Better prompts use precise tasks, controlled scope and neutral language.
- Complex investigations should be divided into orientation, validation, deepening and action stages.
- Analysts should request supporting sources, conflicting evidence, missing data and confidence.
- Reusable prompt patterns improve consistency without replacing incident-specific context.
- KQL prompts should identify the environment, tables, time range, filters, output columns and schema assumptions.
- Leading prompts can produce convincing but unsupported narratives.
- Prompt quality improves the investigation, but source evidence still determines the conclusion.
What Agent Foskett checked
- Prompt objective
- Scope
- Time range
- Entities
- Neutral wording
- Source context
- Evidence request
- Uncertainty
- Output format
- Follow-up focus
Best practices
- Keep one objective per prompt.
- Use neutral hypotheses.
- Define entities and time.
- Request structured output.
- Ask for evidence.
- Ask for conflicts and gaps.
- Use iterative follow-ups.
- Validate generated KQL.
- Protect sensitive data.
- Review before acting.
Related Agent Foskett resources
Continue the Microsoft Security Copilot Academy
How do you write better Microsoft Security Copilot prompts?
Better Security Copilot prompts use precise tasks, controlled scope, neutral wording, relevant sources, structured output and explicit evidence and uncertainty requirements.
Security Copilot prompt examples
Reusable prompt patterns can support incident summaries, identity investigations, email analysis, endpoint investigations, cloud incidents, threat intelligence, KQL generation and executive reporting.
