Email Threat Analysis
The prompt
In Microsoft Defender XDR (email & collaboration), investigate the email with [message ID / subject / sender] received by [recipient UPN] on [date]. Provide: 1. Sender details: display name, actual sending address, sending IP, and reputation 2. URL analysis: list all URLs in the email and their verdict (safe, suspicious, malicious, unknown) 3. Attachment analysis: list attachments, file type, hash, and verdict if available 4. Delivery action taken by Defender: what happened to the email? 5. Was this email sent to other recipients in the organisation? If yes, how many? Conclude with a one-paragraph verdict: phishing, malware delivery, business email compromise, spam, or benign.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
SOC Analyst L1/L2, Email Security Analyst
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.