Soc Operations

# Copilot for Security — SOC Operations

> 20 SCU-optimized prompts for SOC analysts. Each prompt specifies the data source, scope, and output format to minimize follow-up interactions and SCU consumption.

**REQUIRES:** Microsoft Copilot for Security (standalone portal or embedded experience). These prompts do NOT work in Microsoft 365 Copilot Chat. Copilot for Security requires separate provisioning — see the [README](./README.md) for SCU and licensing details.

**Category:** Security Operations

**Prompts:** 20

---

## SCU NOTE — Read Before Using

Each prompt below follows the 4-element structure (goal + data source + scope + output format). Using prompts as written keeps SCU consumption to 1–2 per interaction. Modifying them to be more open-ended (removing the data source, removing the output format) will increase SCU consumption.

---

## Incident Triage

### 1. First Look — Incident Summary

Use when a new high-severity incident lands and you need a fast, structured overview before diving in.

**Target Personas:** SOC Analyst L1/L2, Incident Responder

**Tags:** `incident`, `triage`, `defender-xdr`, `scu-efficient`

**Prompt:**