Triage a security alert and decide if it is a real threat
Walks through a SIEM or EDR alert to a true/false positive call, a severity, and the next actions to take.
The prompt
Help me triage a security alert and decide whether it is a real threat.
Alert details: [PASTE the alert name, rule, timestamp, host, user, process, IPs, hashes - remove secrets]
Source tool: [e.g. "Microsoft Defender", "CrowdStrike", "Splunk", "Sentinel"]
What I already know about this host or user: [role, normal behavior, recent changes, travel - or "nothing yet"]
Related events I can see: [OTHER LOGS OR ALERTS around the same time - optional]
Our environment: [e.g. "Windows + M365", "mixed Linux servers in AWS"]
Steps:
1. Summarize what the alert claims happened in plain words.
2. List the benign explanations and the malicious explanations that fit the evidence, and what would distinguish them.
3. Give me the specific checks to run next (exact log sources, fields, or queries), in priority order, with what a "bad" result would look like.
4. Map the suspicious behavior to MITRE ATT&CK techniques where it clearly applies.
5. Recommend a verdict: likely false positive / needs investigation / likely true positive. State your confidence and what would change it.
Rules:
- Base conclusions only on the evidence I gave. Mark assumptions as [ASSUMPTION] and gaps as [NEED: ...].
- Do not tell me an indicator is known-malicious unless I provided threat intel saying so; tell me where to check instead.
- If it looks like active compromise, put containment steps first (isolate host, disable account, preserve evidence) and remind me to follow our incident process.
Return: a one-line verdict, the reasoning, a next-checks table (Check | Where | What bad looks like), and a short ticket note I can paste.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Software Development prompts
What to fill in
- OTHER LOGS OR ALERTS around the same time - optional
- e.g. "Windows + M365", "mixed Linux servers in AWS"
- ASSUMPTION
- NEED: ...
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Summarize a malware analysis into IOCs and detection stepsTurns sandbox reports, threat intel, and analyst notes into a structured malware summary with indicators, ATT&CK mapping, and next actions.
- Summarize a cyber threat report into insights and actionsDistills a threat intelligence report into its key findings, attacker techniques, indicators, and the actions your security team should take.
- Protect my AI chatbot or LLM feature from prompt injection and data leaksA layered security plan and code-level checklist for LLM endpoints: injection defenses, data leakage controls, abuse limits, and logging.
- Break a feature into small, shippable pull requestsSplits a large feature into a sequence of small, independently mergeable PRs with a safe order and clear scope for each.