Write a detection query or SIEM rule from a description
Turns a threat you want to catch into a working query for your SIEM, with tuning notes and test cases.
The prompt
Write a detection query for our SIEM based on what I want to catch.
What I want to detect: [BEHAVIOR in plain words - e.g. "a user added to Domain Admins outside a change window", "many failed logins followed by a success"]
Query language: [KQL (Sentinel/Defender) / SPL (Splunk) / Sigma / Elastic EQL / other]
Data sources and table names: [e.g. "SecurityEvent", "SigninLogs", "index=wineventlog" - and key field names if I know them]
Known normal activity to exclude: [service accounts, admin hosts, scheduled jobs]
Alert volume I can handle: [e.g. "under 5 per day"]
Provide:
1. The detection logic in plain words, and the MITRE ATT&CK technique it maps to.
2. The query, commented line by line.
3. Required log sources or audit settings that must be enabled (e.g. specific Windows event IDs or audit policies).
4. Tuning: thresholds and time windows with reasoning, plus an allowlist approach that will not hide real attacks.
5. Known false positive sources and blind spots or simple evasions.
6. How to test it safely: a benign way to generate a true positive in a lab, and what result to expect.
7. A triage note for analysts: what to check first when it fires.
Rules: use only field names I gave or standard schema fields, and mark any you are unsure of as [VERIFY FIELD]. Tell me to run it against historical data before enabling alerts.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Software Development prompts
What to fill in
- service accounts, admin hosts, scheduled jobs
- e.g. "under 5 per day"
- VERIFY FIELD
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Write precise TypeScript types for my data and APIsSafer, readable TypeScript types that rule out impossible states, replace unsafe casts, and come with compile-time tests.
- Write a style guide that documents my app's existing design codeReverse-engineers colors, typography, spacing, and component patterns from your codebase into a STYLE_GUIDE.md developers and AI agents can follow.
- Write a Semgrep rule to catch a risky code patternProduces a working Semgrep rule with test cases, so you can block a bug or security pattern across your codebase.
- Set up environment config and secrets across dev, staging, and productionA clean plan for environment variables, secrets handling, and Docker config so each environment works and nothing sensitive leaks.