Promptbooks in Microsoft Security Copilot contain one or more prompts that were together to accomplish specific security-related tasks. They run one prompt after another, building on previous responses.

You can create your own promptbook with the promptbook builder to automate investigation flows and optimize repetitive steps in Copilot that’s customized to your needs and requirements. Check if you have appropriateaccess and permissions to create promptbooks.

You can also share the promptbooks you’ve created with other users like your team mates so they can also benefit from your work.

Watch the following video to learn more about building your own promptbooks:

Create a promptbook from an existing session

In the course of interacting with Security Copilot for your security workflows, you might realize that you regularly run the same set of prompts for different entities. This is a good opportunity to build your own promptbook, which allows you to specify a parameter if needed.

Name your promptbook

To create your own promptbook, you can start with an existing session that contains the prompts you want to work with.

Select the checkboxes beside the prompts to include them or select the top box to include all prompts in the session. Selecting any, or all, of the prompts light up theCreate promptbook button.

SelectCreate promptbook to start building it. Give your promptbook aName.

SupplyTags. Separate each tag or keyword by pressingEnter.

Add aDescription for your promptbook.

Create or edit your prompts

You can tweak the prompt text further and reorder the prompts, but keep in mind that this might affect Copilot’s response in unexpected ways.

Specify any required input

Review your prompts. Decide which items you need as input, if any, the next time you run your promptbook.

For example, if a threat actor name is a required input, replace the threat actor name with<threatactorname> or<ThreatActor> or any easily understood parameter name as long as you useangle brackets andno spaces to define it.

You can add more than one parameter.

Double-check that you have properly defined your required inputs by reviewing the sectionInputs you’ll need. Your defined parameter should appear here. Otherwise, edit the prompt to make sure the parameter is defined by angle brackets with no spaces in between.

Set prompts to continue on failure

You can set any of the prompts to move to the next prompt if that prompt fails by selecting the pencil icon beside the prompt. ToggleContinue on failure (this setting is off by default) and save the promptbook.

You can edit this setting after creating your promptbook, too.

You can only set a prompt to continue on failure in promptbooks that you can edit.

Call system capabilities in the prompt (preview)

You can also add a system capability in your prompt so that it calls the desired action directly, allowing more efficient response generation. To view the list of system capabilities, select the sparkle button on the right side of the individual prompt.

Selecting the button displays the system capabilities that you currently have access to. Choose one to use.

Add prompt text if desired. Select the check icon to save.

Saving the prompt that uses the system capability displays the capability along with the required or optional inputs for the capability to work.

Required inputs appear with a red asterisk (as in above), while optional inputs appear below them (see below).

Set who can use your promptbook

You can then define if this promptbook can be used only by you (Just me) or if you would like to share it (Anyone in my organization). You can change this setting later.

Finally, selectCreate to create your new promptbook. Wait for the loading screen to finish until you see thePromptbook created message.

Test your promptbook

To immediately test your promptbook, select theView icon that appears after promptbook creation.

Another way to access your promptbook is to go to the main prompt bar and select the sparkle icon. Enter the first few characters of your new promptbook until it appears in the drop up menu.Select your promptbook.

Select your promptbook.

In the promptbook Run page, insert any required parameters that you set earlier and selectRun.

If you need to make changes to your new promptbook, read the following section,Edit your promptbook.

To run a promptbook, readRun a promptbook.

Edit your promptbook

To edit your existing promptbook, go to thePromptbook library from the main menu and look for your promptbook.

Select the ellipses () then selectEdit from the options. You can only edit existing promptbooks if you're the owner of the promptbook.

You can edit the promptbookName,Tags,Description, prompt details, parameter inputs, and the like, including the order of the prompts.

Once you're satisfied with your edits, selectSave.

Duplicate a promptbook

You can duplicate an existing promptbook, whether or not you own it, so that you can preserve the original promptbook while tweaking the prompts for your own purposes.

To do this, go to thePromptbook library in the main menu and look for the promptbook you want to duplicate.

You can either:

• Select then selectDuplicate from the options, or
• Select then selectDetails from the options and select theDuplicate icon in the upper right corner

TheDuplicate promptbook dialog box allows you to edit the promptbookName,Tags,Description, prompt details, parameter inputs, and the like, including the order of the prompts.

Once you're satisfied with your edits, selectDuplicate.

You can then find the duplicate promptbook in the Promptbook library with a "(Copy)" string at the end of the promptbook name.

Share an existing promptbook

To share an existing promptbook that you own, go to thePromptbook library in the main menu and look for your promptbook.

Select, then selectDetails from the options.

If you're the owner of the promptbook, you can selectShare to get a link to the promptbook, which you can then share with other users in your organization.

Run a promptbook

Go to thePromptbook library in the main menu and look for the promptbook that you want to run.

You can run the promptbook immediately by selecting the arrow that appears when you hover the promptbook row. This starts a new session and prompts you to fill in any required inputs.

As with any session, you can reorder and edit the prompts before running it. However, the changes only take effect in the current session unless you save the changes to the promptbook.

SelectRun once done.

Alternatively, you can check the details of the promptbook first by selecting the ellipses then selectingDetails from the options.

From here, you can read the details of the promptbook. SelectStart new session to run the promptbook. This opens the promptbook window where you can fill in the required inputs.

SelectRun once done.

Delete a promptbook

In the promptbook library, select the ellipses beside the promptbook name.SelectDelete. The following confirmation message appears.

SelectDelete to confirm permanent deletion of the selected promptbook.

Best practices and concepts to consider

Promptbooks are a great way to automate investigation flows in Copilot by security teams. Consider the following best practices and concepts when creating your own promptbooks:

• Createeffective prompts. Clearly defining your objectives can help you in crafting more specific initial and follow-up questions and prompts.
• Find a good balance between the number and complexity of your prompts. The number of prompts in your promptbook might or might not have an effect onsecurity compute unit (SCU) consumption, but in general, too many prompts can mean more resource consumption. On the other hand, prompts that are too verbose and complicated can be as counter-productive and resource-heavy. Check if each prompt contributes to your objective or whether it’s possible to streamline some prompts.
• When creating or editing a promptbook from an existing session, you might consider reordering the prompts. However, keep in mind that doing so might have an effect on your final output. Promptbooks run the prompts one after another, with the results of a previous prompt used or considered in succeeding prompts. Again, this might have an effect onSCU consumption.
• If your promptbook is taking longer than expected to run, which might mean it's consuming many SCUs, you can selectCancel to stop the promptbook midway through.
• When a promptbook is open in an existing session, you can edit the content and order of prompts without changing the original promptbook, but as mentioned earlier, changing the content and order of the prompts might affect the response and resource consumption.
• The output of a promptbook can vary from session to session, the same way a single prompt can result in slightly different responses even in the same session. Some randomness is expected in any natural language-based, AI-powered solution.

See also

• Try promptbooks
• Create effective prompts