KQL Query Generation — Save for Reuse
The prompt
Write a KQL query for Microsoft Sentinel (or Defender XDR advanced hunting — specify which) that detects the following behaviour: [DESCRIBE THE BEHAVIOUR IN PLAIN LANGUAGE]. Requirements: - The query should cover a configurable time window (use a variable at the top for easy adjustment) - Include comments explaining each major section - Return results as a table with columns: timestamp, entity (user or device), action, source, and severity if applicable - Include a count of events per entity so I can identify which entities are generating the most hits After the query, add a one-paragraph explanation of the detection logic and any known false positive scenarios I should filter out.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
Threat Hunter, SOC Analyst L3, Detection Engineer
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.