Summarize a cyber threat report into insights and actions
Distills a threat intelligence report into its key findings, attacker techniques, indicators, and the actions your security team should take.
The prompt
Summarize this cybersecurity threat report for my team and turn it into actions.
Report: [PASTE the threat report, advisory, or blog post]
Our environment: [e.g. "Microsoft 365, AWS, Windows endpoints with EDR, 400 users", or "general"]
Audience for the summary: [security analysts / IT team / executives]
Give me:
1. One-sentence summary of what the report reveals, under 25 words.
2. Key findings: the 5-10 most important or surprising points, each in one or two sentences.
3. Threat actor and campaign: who is behind it (as attributed in the report, with the report's confidence level), targets, motivation, and timeline.
4. Attack chain: initial access through impact, with each step mapped to MITRE ATT&CK tactics and techniques where the report supports it.
5. Indicators of compromise in a table: Type | Value | Context. Copy indicators exactly as written in the report, keep them defanged (e.g. hxxp, [.]), and don't add any that aren't in the report.
6. Relevance to us: which findings apply to my environment and why, or "not enough information".
7. Recommended actions, split into: check now (hunting queries to run, logs to review), fix this month (patches, configuration changes), and longer term (controls and detections).
8. A 3-sentence plain-language version for executives.
Stick to what the report says. Separate the report's facts from your interpretation, and mark anything you're unsure of [VERIFY]. Note the report date, since threat details age quickly.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Software Development prompts
What to fill in
- PASTE the threat report, advisory, or blog post
- security analysts / IT team / executives
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Summarize a malware analysis into IOCs and detection stepsTurns sandbox reports, threat intel, and analyst notes into a structured malware summary with indicators, ATT&CK mapping, and next actions.
- Break a feature into small, shippable pull requestsSplits a large feature into a sequence of small, independently mergeable PRs with a safe order and clear scope for each.
- Analyze logs to find what went wrongReads logs to identify errors, patterns, and the likely root cause.
- Get a beginner-friendly code review of my first projectA ranked set of the five improvements that matter most, explained simply, plus what you did well and what to learn next.