Creating Promptbooks in Copilot for Security
There a number of Promptbooks included with Copilot for Security, but over time you may need to create your own.
While prompts are generally single-use, Promptbooks are a way to store a series of related prompts into a shareable, reusable collection of prompts.
Looking for prompts to use? See the Prompt Library: https://aka.ms/CfSPromptLibrary
Promptbooks in Microsoft Security Copilot are collections of prompts designed to accomplish specific security-related tasks.
An important difference between a single prompt and Promptbook is that a Promptbook requires a specific input. Each promptbook requires a specific input, such as an incident number, a threat actor name, or a script string.
There a number of Promptbooks included with Copilot for Security, but over time you may need to create your own.
For an example of a series of prompts in a Promptbook, see: Microsoft 365 Defender incident investigation
Create a Promptbook
Once you have identified a series of prompts that accomplish the intended task, you locate the checkbox next to each prompt and select it. Once you have the series selected, click the Create Promptbook option at the top of the Copilot for Security screen.
Once the ‘Create a prompt book’ screen is visible, modify the following:
Give it a name.
Supply a tag or tags to organize the Promptbook with any of the others you create.
Give it a solid description. If this is shared across your organization, this description will be important.
Take the original prompt and supply an Input. In the case of the example, I removed the actual Defender Incident number (2532) from the single prompt and replaced it with the following to ensure the Promptbook is reusable in multiple cases.
Summarize Defender incident <DEFENDER_INCIDENT_ID>.
Lastly, at the bottom of the Promptbook creation mechanism, configure who will be able to use the Promptbook (just me or anyone in my organization) and then click the Create button.
Once created, the custom Promptbook will be included in the Promptbook library along with all other Promptbooks that are part of your tenant.
When you choose to run your custom Promptbook, you will be prompted for the input you provided, and all the included prompts will run.
Want to discuss this further? Hit me up on Twitter or LinkedIn]
[Subscribe to the RSS feed for this blog]
[Subscribe to the Weekly Microsoft Sentinel Newsletter]
[Subscribe to the Weekly Microsoft Defender Newsletter]
[Subscribe to the Weekly Azure OpenAI Newsletter]
[Learn KQL with the Must Learn KQL series and book]
[Learn AI Security with the Must Learn AI Security series and book]