# How do you validate Microsoft Security Copilot recommendations during incident investigations?

I like how Microsoft Security Copilot uses natural language prompts to summarize security alerts, analyze large volumes of security data, and speed up threat detection and incident investigations, especially when integrated with tools like Microsoft Defender and Microsoft Sentinel.

However, I have noticed that some AI-generated responses still require careful verification. Complex investigations can sometimes take multiple prompts to get consistent and accurate results. There is also a learning curve for users who are not already familiar with Microsoft's security ecosystem.

I am interested in understanding how other security professionals validate Copilot's recommendations before taking action. Do you cross-check its findings against security logs, endpoint telemetry, and threat intelligence? Also, what techniques do you use to improve prompt quality and get more reliable results?

I would appreciate hearing about practical approaches that help keep investigations fast without compromising accuracy.

##### Post Metadata
- Posted at: 2 days ago
- Author title: Senior Data Engineer | SQL • PySpark • Python • Snowflake • Airflow• SSIS | Serving Notice Period
- Net upvotes: 1



## Related Product
[Microsoft Security Copilot](https://www.g2.com/products/microsoft-security-copilot/reviews)

## Related Category
[Security Orchestration, Automation, and Response (SOAR)](https://www.g2.com/categories/security-orchestration-automation-and-response-soar)

## Related discussions
- [How well does Trello scale into a larger team?](https://www.g2.com/discussions/1-how-well-does-trello-scale-into-a-larger-team)
  - Posted at: over 13 years ago
  - Comments: 6
- [Can we please add a new section](https://www.g2.com/discussions/2-can-we-please-add-a-new-section)
  - Posted at: over 13 years ago
  - Comments: 0
- [Quantifiable benefits from implementing your CRM](https://www.g2.com/discussions/quantifiable-benefits-from-implementing-your-crm)
  - Posted at: over 13 years ago
  - Comments: 4