Insider Risk Signal Review
The prompt
In Microsoft Purview Insider Risk Management, review the current open alerts for user [UPN]. Provide: 1. Alert summary: what risk indicators triggered the alert? 2. Activity timeline: what actions did the user take that contributed to the risk score? 3. Risk score and severity level 4. Has this user had prior alerts in the last 90 days? 5. What policies is this user included in? Do not recommend disciplinary action. Return a factual activity summary suitable for review by HR or Legal.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
Compliance Analyst, SOC Analyst L2
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.