Security Metrics Dashboard Preparation
The prompt
Pull the following security metrics for [PERIOD — e.g. "last 30 days" or "Q1 2026"] from Microsoft Defender XDR and Microsoft Sentinel: 1. Total incidents: breakdown by severity 2. Mean time to detect (MTTD): average time from first alert to incident creation 3. Mean time to respond (MTTR): average time from incident creation to resolution, for critical and high severity 4. False positive rate: percentage of alerts closed as false positive 5. Alert volume by data source (Defender XDR, Sentinel, Entra, Purview) 6. Top 5 MITRE ATT&CK techniques observed 7. Devices with active critical alerts: count Return as a metrics table. Flag any metric where data is unavailable or may be incomplete, and note what manual query would retrieve it.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
Security Manager, SOC Lead, CISO
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.