# Write a detection query or SIEM rule from a description

Turns a threat you want to catch into a working query for your SIEM, with tuning notes and test cases.

- Topic: Software Development
- Framework: Few-Shot
- Level: Standard
- Tags: Write, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/write-a-detection-query-or-siem-rule-from-a-description

## Prompt

```text
Write a detection query for our SIEM based on what I want to catch.

**What I want to detect:** [BEHAVIOR in plain words - e.g. "a user added to Domain Admins outside a change window", "many failed logins followed by a success"]
**Query language:** [KQL (Sentinel/Defender) / SPL (Splunk) / Sigma / Elastic EQL / other]
**Data sources and table names:** [e.g. "SecurityEvent", "SigninLogs", "index=wineventlog" - and key field names if I know them]
**Known normal activity to exclude:** [service accounts, admin hosts, scheduled jobs]
**Alert volume I can handle:** [e.g. "under 5 per day"]

Provide:
1. The detection logic in plain words, and the MITRE ATT&CK technique it maps to.
2. The query, commented line by line.
3. Required log sources or audit settings that must be enabled (e.g. specific Windows event IDs or audit policies).
4. Tuning: thresholds and time windows with reasoning, plus an allowlist approach that will not hide real attacks.
5. Known false positive sources and blind spots or simple evasions.
6. How to test it safely: a benign way to generate a true positive in a lab, and what result to expect.
7. A triage note for analysts: what to check first when it fires.

Rules: use only field names I gave or standard schema fields, and mark any you are unsure of as [VERIFY FIELD]. Tell me to run it against historical data before enabling alerts.
```

## What to fill in

- service accounts, admin hosts, scheduled jobs
- e.g. "under 5 per day"
- VERIFY FIELD

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.