Alert Triage — Is This a True Positive?
The prompt
In Microsoft Defender XDR, analyze alert [ALERT ID]. Answer these questions: 1. What activity triggered this alert? 2. Has this alert type fired for this user or device before in the last 30 days? If yes, how many times and what was the resolution? 3. Is the triggering activity consistent with the user's normal behaviour based on available context? 4. What is your assessment: likely true positive, likely false positive, or requires investigation? State your reasoning in one paragraph. Do not recommend remediation actions — assessment only.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
SOC Analyst L1, Tier 1 Triage
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
- User Investigation — Credential Compromise Assessment
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.