First Look — Incident Summary
The prompt
Summarize incident [INCIDENT ID] in Microsoft Defender XDR. Include: 1. What happened (one paragraph, plain language) 2. Affected entities: list all users and devices involved 3. Attack timeline: key events in chronological order 4. Current status: contained, active, or unknown 5. Recommended immediate actions Format as a structured incident brief. Flag any entity that appears across more than one alert in this incident.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
SOC Analyst L1/L2, Incident Responder
More for Microsoft Copilot for Security
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
- User Investigation — Credential Compromise Assessment
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.