# Triage a security alert and decide if it is a real threat

Walks through a SIEM or EDR alert to a true/false positive call, a severity, and the next actions to take.

- Topic: Software Development
- Framework: Few-Shot
- Level: Advanced
- Tags: Summarize, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/triage-a-security-alert-and-decide-if-it-is-a-real-threat

## Prompt

```text
Help me triage a security alert and decide whether it is a real threat.

**Alert details:** [PASTE the alert name, rule, timestamp, host, user, process, IPs, hashes - remove secrets]
**Source tool:** [e.g. "Microsoft Defender", "CrowdStrike", "Splunk", "Sentinel"]
**What I already know about this host or user:** [role, normal behavior, recent changes, travel - or "nothing yet"]
**Related events I can see:** [OTHER LOGS OR ALERTS around the same time - optional]
**Our environment:** [e.g. "Windows + M365", "mixed Linux servers in AWS"]

Steps:
1. Summarize what the alert claims happened in plain words.
2. List the benign explanations and the malicious explanations that fit the evidence, and what would distinguish them.
3. Give me the specific checks to run next (exact log sources, fields, or queries), in priority order, with what a "bad" result would look like.
4. Map the suspicious behavior to MITRE ATT&CK techniques where it clearly applies.
5. Recommend a verdict: likely false positive / needs investigation / likely true positive. State your confidence and what would change it.

Rules:
- Base conclusions only on the evidence I gave. Mark assumptions as [ASSUMPTION] and gaps as [NEED: ...].
- Do not tell me an indicator is known-malicious unless I provided threat intel saying so; tell me where to check instead.
- If it looks like active compromise, put containment steps first (isolate host, disable account, preserve evidence) and remind me to follow our incident process.

Return: a one-line verdict, the reasoning, a next-checks table (Check | Where | What bad looks like), and a short ticket note I can paste.
```

## What to fill in

- OTHER LOGS OR ALERTS around the same time - optional
- e.g. "Windows + M365", "mixed Linux servers in AWS"
- ASSUMPTION
- NEED: ...

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.