Threat Intelligence Enrichment — IOC Lookup
The prompt
Using Microsoft Defender Threat Intelligence, look up the following indicator: [IP ADDRESS / DOMAIN / FILE HASH]. Provide: 1. Reputation score and verdict (malicious, suspicious, benign, unknown) 2. Associated threat actors or malware families, if any 3. First seen and last seen dates in threat intelligence feeds 4. Related CVEs or exploits associated with this indicator 5. Has this indicator been observed in your organisation's environment in the last 30 days? If yes, on which devices or by which users? Return as a structured brief. Conclude with a recommended action: block, monitor, or no action needed.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
SOC Analyst L2/L3, Threat Intelligence Analyst
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.