Multi-Alert Correlation — Single Incident Thread
The prompt
I have the following alert IDs that may be related: [LIST ALERT IDs]. In Microsoft Defender XDR, examine these alerts and determine: 1. Do these alerts share common entities (users, devices, IPs, file hashes)? List the shared entities. 2. Is there a logical sequence — do any alerts appear to be precursors or consequences of others? 3. Should these be merged into a single incident? State yes or no with one-paragraph reasoning. Return a table of alerts with columns: Alert ID, Timestamp, Entity, Tactic (MITRE), and your correlation assessment.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
SOC Analyst L2/L3, Threat Hunter
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Device Investigation — Rapid Scope
- User Investigation — Credential Compromise Assessment
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.