Zero-Day and Active Exploit Exposure Check
The prompt
In Microsoft Defender XDR (Threat & Vulnerability Management), check our environment's exposure to [CVE ID]. Provide: 1. Are any devices in the environment running affected software versions? If yes, how many? 2. List the top 10 most critical affected devices (prioritise servers and devices handling sensitive data) 3. Is a patch or official mitigation available from the vendor? 4. Has this CVE been observed in active exploitation in the wild (check threat intelligence if available)? 5. Recommended immediate action: patch now, apply workaround, monitor, or no action I need this within the next 30 minutes — prioritise speed over completeness. Flag anything I need to verify manually.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
CISO, Security Manager, SOC Lead
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.