10 Microsoft Copilot Prompts Every Security Analyst Should Steal

Most people use Microsoft Copilot for security like it's a search engine that talks back. They ask it vague questions, get vague answers, decide the tool is overhyped, and go back to doing everything by hand.

The tool isn't the problem. The prompt is. Copilot is only as good as the instructions you give it, and a lazy prompt gets you a lazy answer. A precise, structured prompt that tells it exactly what role to play, what to analyze, and what format to return turns it from a novelty into something that actually saves you time on a shift.

I use Copilot for the parts of the job that eat time without requiring much creativity: summarizing noisy incidents, drafting the first version of a report, translating an idea into a KQL query, explaining an obfuscated script so I can move faster. The trick is always the prompt.

So here are ten prompts worth stealing. Each one comes with what it does, why it's useful, and the actual prompt to copy. They're written so you can paste them in and swap the bracketed parts for your own data. None of them replace your judgment. They just get you to the part where your judgment matters faster.

1. The Incident Summarizer

**What it does:**Takes a messy, multi alert incident and turns it into a clean, ordered summary you can actually reason about, instead of scrolling through forty raw events trying to hold the timeline in your head.

Why its useful: The slowest part of working a complex incident is often just understanding what happened and in what order. Handing the raw data to Copilot with a clear structure request gets you a timeline in seconds, which you then verify instead of building from scratch.

Act as a senior SOC analyst. Below is the raw data for a security incident. Summarize it into: (1) a one paragraph plain English overview, (2) a chronological timeline of key events with timestamps, (3) the entities involved (users, hosts, IPs), and 4) the three most important unanswered questions I should investigate next. Do not speculate beyond the data provided.

[paste incident data here]

2. The KQL Translator

What it does: Turns a plain English description of what you want to find into a working KQL query for Microsoft Sentinel or Defender, so you don't have to remember exact table and column names every time.

Why it's useful: Most analysts know what they want to hunt for long before they can write the query that finds it. This closes that gap. You describe the hunt, you get a starting query, you refine it. It's the difference between a five minute task and a forty minute one when you're rusty on syntax.

Write a KQL query for Microsoft Sentinel that finds [describe what you want to find in plain English]. Use the [table name] table. Explain what each line of the query does in a comment above it,and tell me which fields I might need to adjust for my environment. If there is a more efficient / optimized way to write this, show that version too.

3. The Phishing Header Analyst

What it does: Walks through raw email headers and points out the authentication results and red flags, so you get a fast second read on a suspicious message.

Why it's useful: Phishing triage is the most common Tier 1 task there is. Pasting headers in and getting a structured breakdown of the SPF, DKIM, and DMARC results plus the routing path gives you a quick sanity check against your own analysis. You still make the call. It just surfaces the things worth looking at first.

Act as an email security analyst. Analyze the following raw email headers. Tell me: (1) the SPF, DKIM, and DMARC results and what each one means here, (2) whether the reply path and return path match the sender, (3) the full routing path and anything unusual about it, and (4) a verdict of likely legitimate, suspicious, or likely malicious, with your reasoning. Do not just describe the headers, interpret them. [paste email headers here]

4. The Script Explainer

What it does: Takes an obfuscated or just confusing PowerShell or command line string and explains, in plain language, what it actually does, without you running it.

Why it's useful: When a suspicious script fires an alert, the worst thing you can do is execute it to see what happens. Asking Copilot to explain it gives you the intent fast and safely. You read the explanation, you confirm the indicators, you never run the thing. This is one of the biggest time savers for anyone newer to reading scripts.

Explain what the following PowerShell command does, step by step, in plain English. If any part of it is encoded or obfuscated, decode and explain it. Identify anything that would be suspicious in a corporate environment, such as downloading files, disabling security tools, establishing persistence, or contacting external addresses. Do not provide a cleaned up or runnable version, only explain the existing one.

[paste script here]

5. The IOC Enricher

**What it does:**Takes a set of indicators (IPs, domains, hashes) and organizes what you know about them, plus tells you what questions to ask to enrich them further.

Why it's useful: When you're pivoting through an investigation, you accumulate a pile of indicators fast. This prompt helps you organize them and think clearly about which ones matter and what context you still need to pull, rather than letting them sit in a scratchpad.

I am investigating a potential intrusion. Below are the indicators of compromise I have collected so far. Organize them into a table by type (IP, domain, file hash, etc). For each one, list what it was associated with in my notes, and suggest the specific next enrichment step I should take to confirm whether it is malicious. Flag any indicators that look related to each other.

[paste your IOCs and notes here]

6. The Detection Logic Drafter

What it does: Helps you turn a described attacker behavior into the logic for a detection rule, including what to alert on and how to reduce false positives.

Why it's useful: Writing good detections is a senior skill, and the hardest part is thinking through the false positive surface before you ship the rule. Using Copilot as a thinking partner here helps you pressure test your logic before it floods the queue with noise.

I want to build a detection for the following attacker behavior: [describe the behavior]. Help me think through the detection logic. Tell me: (1) what specific events or conditions should trigger it, (2) the legitimate activity that could look identical and cause false positives, (3) how I could tune the rule to separate the two, and (4) what an analyst should check first when this alert fires. Keep it tool agnostic so I can implement it in my SIEM.

7. The Log Parser

What it does: Takes a block of raw, ugly log output and extracts the fields that matter into a readable table.

Why it's useful: Half of log analysis is just making the log readable. Pasting in a wall of unstructured log lines and asking for the relevant fields in a table saves you from squinting at raw text and missing the one line that matters.

Below is raw log output. Parse it into a clean table with one row per event. Include only these columns: timestamp, source, action, and result. After the table, point out any rows that look anomalous compared to the rest and explain why. Keep the original timestamps exactly as written.

[paste raw logs here]

8. The Vulnerability Prioritizer

What it does: Takes a list of vulnerabilities and helps you reason about which to address first based on real risk, not just the raw severity score.

Why it's useful: A vulnerability scanner will hand you hundreds of findings and call half of them critical. The actual skill is prioritizing based on exploitability, exposure, and what the asset actually is. This prompt helps you think past the score to the real risk.

Below is a list of vulnerabilities from a scan. Help me prioritize remediation. For each one, consider not just the severity score but also whether it is known to be actively exploited, whether the affected asset is internet facing, and what the realistic impact would be. Rank them from address first to address later, and explain the reasoning for the top three.

[paste vulnerability list here]

9. The Executive Summary Writer

This one is honestly my favorite one lol.

What it does: Turns your technical incident notes into a clear, non technical summary a manager or stakeholder can actually understand.

Why it's useful: Translating technical work into language leadership understands is a skill that gets analysts noticed and promoted, and it's one most people are bad at. This gives you a strong first draft you then refine, instead of staring at a blank page trying to explain a credential compromise to someone who doesn't know what a token is.

Turn the following technical incident notes into a short executive summary for non technical leadership. Use plain language, avoid jargon, and structure it as: what happened, what the impact was or could have been, what we did about it, and what we recommend next.

Keep it under 200 words and do not overstate the severity.

[paste your technical notes here]

10. The Alert Tutor

What it does: Explains an alert type you're unfamiliar with, including what causes it, what is benign versus malicious, and how to investigate it.

Why it's useful: This is the one I'd push hardest on anyone newer to the field. When an alert fires that you don't fully understand, instead of guessing, you ask for a structured explanation and turn a confusing ticket into a learning moment. Over a few months, this quietly builds the exact instincts that separate strong analysts from the rest.

Act as a SOC mentor. Explain the following alert type to me as if

I am a newer analyst: [alert name or description]. Cover: (1) what actually triggers it, (2) the common benign causes I should rule out first, (3) what the malicious version looks like, (4) the specific steps to investigate it in order, and (5) the one mistake new analysts most often make with this alert.

Why the Prompt Is the Whole Game

Notice the pattern across all ten. Every one of them does three things: it assigns Copilot a role, it gives it specific data or a specific task, and it demands a structured output. That's the entire difference between a useful response and a useless one. Vague in, vague out. Specific in, useful out.

That's also why a good prompt is reusable. Once you've built a prompt that reliably produces a clean incident summary or a solid KQL starting point, you don't rebuild it every time. You save it, you swap the data, and you run it again. The analysts who get fast with these tools aren't smarter, they've just built a library of prompts that work and stopped reinventing them on every ticket.

These ten are a starting point, and they cover the most common time sinks in the job. If you want the full set instead of building your library one prompt at a time, I put together 200 Security Prompts for Microsoft Copilot organized by task, each one written and tested the same way as the ten above, with the what it does and why it's useful baked in so you know exactly when to reach for each one. It's $4.99 for all 200, which works out to about two cents a prompt and less than the time it takes to write a handful of good ones yourself.

Steal the ten above to start, and grab the rest for $4.99 when you want your whole workflow covered.

I write a lot more like this on Medium, breaking down the tools and skills that actually make security work faster. If this was useful, hit the subscribe button so my next post lands in your inbox automatically.