Leverage prompting features in Microsoft Security Copilot

  • 3 minutes

Microsoft Security Copilot uses advanced AI to assist security professionals in various tasks, such as incident response, threat hunting, and intelligence gathering. One of the key features that enhances its usability is the ability to create and use custom prompts. These prompts help in extracting precise information from integrated systems like Microsoft Intune.

Creating effective prompts

Be specific and clear

For the best results, your prompts should be clear and specific. Including details such as device IDs, app names, or policy names can significantly improve the accuracy of the information retrieved. For example, instead of asking a general question, you might say, “According to Intune, how many devices were enrolled this week?” or “Tell me about Intune devices for [user name].”

Experiment and iterate

Different AI models respond better to varying prompts, so it’s beneficial to experiment with different phrasing and structures. Refine your prompts based on the results you receive to ensure they're delivering the information effectively.

Use Intune in prompts

Adding “Intune” to your prompts helps direct the AI to focus on Intune-specific data. Examples include:

  • “How many devices were enrolled in Intune in the last 24 hours?”
  • “Tell me about Intune devices for Jon Smith.”

Using promptbooks

Saving effective prompts in a promptbook allows you to reuse them in the future. This can save time and ensure consistency in the information retrieved.

Sample prompts for various scenarios

General information

To get a broad overview of your Intune data, you can use prompts like:

  • “What apps are added to Intune?”
  • “How many devices were enrolled in Intune in the last 24 hours?”

Policy targets

For detailed information on policy targets, you might ask:

  • “How many users are ContosoApp assigned to?”
  • “Which groups are ContosoApp assigned to?”

Specific devices

To retrieve data on specific devices, use prompts such as:

  • “What devices are used by UserA@contoso.com?”
  • “Who is the primary user for DeviceA?”

Similarities and differences

Comparing two devices can be done with prompts like:

  • “What are the similarities in compliance policies between DeviceA and DeviceB?”
  • “Compare installed applications on DeviceA and DeviceB.”

Monitoring and refining prompts

Regularly review the effectiveness of your prompts and refine them as needed. Feedback mechanisms within Security Copilot can help you understand how well your prompts are performing and what adjustments might be necessary.

Using the prompting features in Microsoft Security Copilot can significantly enhance your ability to manage and secure your digital environment. By creating clear, specific prompts and refining them over time, you can ensure that you're getting the most accurate and actionable information possible.