DLP Alert Investigation
The prompt
In Microsoft Purview, investigate DLP alert [ALERT ID or description]. Provide: 1. What sensitive data type was detected (e.g. credit card numbers, PII, classified content)? 2. What action triggered the alert — email send, file share, Teams message, or other? 3. Who was the user involved and what was the destination (internal or external)? 4. Was the data actually exfiltrated, or was it caught before leaving the organisation? 5. What policy was triggered and what action did it take (block, notify, audit only)? Conclude with a recommended next step: close as false positive, notify user, escalate to HR/Legal, or initiate formal investigation.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
SOC Analyst, Compliance Analyst, DLP Analyst
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.