Build your own promptbooks
Promptbooks in Microsoft Security Copilot contain one or more prompts that have been put together to accomplish specific security-related tasks. They run one prompt after another, building on previous responses.
You can create your own promptbook with the promptbook builder to automate investigation flows and optimize repetitive steps in Copilot that’s customized to your needs and requirements. Check if you have appropriate access and permissions to create promptbooks.
You can also share the promptbooks you’ve created with other users like your team mates so they can also benefit from your work.
Watch the following video to learn more about building your own promptbooks:
Create a promptbook from an existing session
In the course of interacting with Security Copilot for your security workflows, you might realize that you regularly run the same set of prompts for different entities. This is a good opportunity to build your own promptbook, which allows you to specify a parameter if needed.
To create your own promptbook, you can start with an existing session that contains the prompts you want to work with.
Select the checkboxes beside the prompts to include them or select the top box to include all prompts in the session. Selecting any, or all, of the prompts light up the Create promptbook button.
Select Create promptbook to start building it. Give your promptbook a Name.
Supply Tags. Separate each tag or keyword by pressing Enter.
Add a Description for your promptbook.
You can tweak the prompt text further and reorder the prompts, but keep in mind that this might affect Copilot’s response in unexpected ways.
Review your prompts and decide which items you need as input, if any, the next time you run your promptbook.
For example, if a threat actor name is a required input, replace the threat actor name with <threatactorname> or <ThreatActor> or any easily understood parameter name as long as you use angle brackets and no spaces to define it.
You can add more than one parameter.
Double-check that you have properly defined your required inputs by reviewing the section Inputs you’ll need. Your defined parameter should appear here. Otherwise, edit the prompt to make sure the parameter is defined by angle brackets with no spaces in between.
You can then define if this promptbook can be used only by you (Just me) or if you would like to share it (Anyone in my organization). You can change this setting later.
Finally, select Create to create your new promptbook. Wait for the loading screen to finish until you see the Promptbook created message.
To immediately test your promptbook, select the View icon that appears after promptbook creation.
Another way to access your promptbook is to go to the main prompt bar and select the sparkle icon 
. Enter the first few characters of your new promptbook until it appears in the drop up menu.
Select your promptbook.
Select your promptbook.
In the promptbook Run page, insert any required parameters that you set earlier and select Run.
If you need to make changes to your new promptbook, read the following section, Edit your promptbook.
To run a promptbook, read Run a promptbook.
Edit your promptbook
To edit your existing promptbook, go to the Promptbook library from the main menu and look for your promptbook.
Select the ellipses (
) then select Edit from the options. You can only edit existing promptbooks if you're the owner of the promptbook.
You can edit the promptbook Name, Tags, Description, prompt details, parameter inputs, and the like, including the order of the prompts.
Important
Editing the prompt text or the order of prompts might affect Copilot’s response in unexpected ways. Promptbooks can contain a series of prompts that are run one after another building on the previous responses, so reordering prompts, for instance, might result in unexpected responses.
Once you're satisfied with your edits, select Save.
Duplicate a promptbook
You can duplicate an existing promptbook, whether or not you own it, so that you can preserve the original promptbook while tweaking the prompts for your own purposes.
To do this, go to the Promptbook library in the main menu and look for the promptbook you want to duplicate.
You can either:
- Select then select Duplicate from the options, or
- Select then select Details from the options and select the Duplicate icon in the upper right corner
The Duplicate promptbook dialog box allows you to edit the promptbook Name, Tags, Description, prompt details, parameter inputs, and the like, including the order of the prompts.
Once you're satisfied with your edits, select Duplicate.
You can then find the duplicate promptbook in the Promptbook library with a "(Copy)" string at the end of the promptbook name.
Share an existing promptbook
To share an existing promptbook that you own, go to the Promptbook library in the main menu and look for your promptbook.
Select , then select Details from the options.
If you're the owner of the promptbook, you can select Share to get a link to the promptbook, which you can then share with other users in your organization.
Important
If you share a promptbook with a user who has different roles, permissions, or level of access to services or plugins than you do, the user might receive a different response from Copilot. The promptbook runs the prompts in the user’s session and Copilot reasons over data that is available to the currently signed in user.
Run a promptbook
Go to the Promptbook library in the main menu and look for the promptbook that you want to run.
You can run the promptbook immediately by selecting the arrow that appears when you hover the promptbook row. This starts a new session and prompts you to fill in any required inputs.
As with any session, you can reorder and edit the prompts before running it. However, the changes only take effect in the current session unless you save the changes to the promptbook.
Select Run once done.
Alternatively, you can check the details of the promptbook first by selecting the ellipses then selecting Details from the options.
From here you can read the details of the promptbook. Select Start new session to run the promptbook. This opens the promptbook window where you can fill in the required inputs.
Select Run once done.
Delete a promptbook
In the promptbook library, select the ellipses beside the promptbook name. Select Delete. The following confirmation message appears.
Select Delete to confirm permanent deletion of the selected promptbook.
Best practices and concepts to consider
Promptbooks are a great way to automate investigation flows in Copilot by security teams. Consider the following best practices and concepts when creating your own promptbooks:
- Create effective prompts. Clearly defining your objectives can help you in crafting more specific initial and follow-up questions and prompts.
- Find a good balance between the number and complexity of your prompts. The number of prompts in your promptbook might or might not have an effect on security compute unit (SCU) consumption, but in general, too many prompts can mean more resource consumption. On the other hand, prompts that are too verbose and complicated can be as counter-productive and resource-heavy. Check if each prompt contributes to your objective or whether it’s possible to streamline some prompts.
- When creating or editing a promptbook from an existing session, you might consider reordering the prompts. However, keep in mind that doing so might have an effect on your final output. Promptbooks run the prompts one after another, with the results of a previous prompt used or considered in succeeding prompts. Again, this might have an effect on SCU consumption.
- If your promptbook is taking longer than expected to run, which might mean it's consuming a lot of SCUs, you can select Cancel to stop the promptbook midway through.
- When a promptbook is open in an existing session, you can edit the content and order of prompts without changing the original promptbook, but as mentioned earlier, changing the content and order of the prompts might affect the response and resource consumption.
- The output of a promptbook can vary from session to session, the same way a single prompt can result in slightly different responses even in the same session. Some randomness is expected in any natural language-based, AI-powered solution.