Incident Post-Mortem Draft
The prompt
In Microsoft Defender XDR, retrieve the full details of incident [INCIDENT ID], which is now closed. Draft a post-mortem report with the following sections: 1. Executive Summary (3 sentences: what happened, impact, how it was resolved) 2. Timeline of Events (chronological, key milestones only) 3. Root Cause 4. Impact Assessment (systems affected, data involved, business disruption) 5. Response Actions Taken 6. Lessons Learned (minimum 3) 7. Recommended Improvements Mark any section where you have insufficient data with [REQUIRES MANUAL INPUT]. I will complete those sections before sending.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
Incident Commander, SOC Lead, Security Manager
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.