AI Prompts Cheatsheet for Incident Response

πŸ€– AI Prompts Cheatsheet

James Calloway — AI Tools Trainer

Why AI Changes the Game for Incident Response

In today’s fast-paced cybersecurity landscape, having AI tools at your disposal can streamline incident response, enabling quicker decision-making and more effective solutions. AI can assist in automating repetitive tasks, analyzing large datasets, and providing insights that human analysts may overlook.

Before You Start: How to Set Context Properly

To effectively use AI for incident response, it’s crucial to provide the right context in your prompts. Begin by outlining the specific incident, its impact, and the data at hand. This will lead to more accurate and relevant responses from the AI model.

Core Prompts Cheatsheet

Summarize the incident details from the following log entries: [insert log entries].

This prompt helps condense complex log data into actionable insights. Use this when needing a quick overview of an incident based on gathered logs.

Identify the potential vulnerabilities in the following system configuration: [insert system details].

Use this when assessing whether a system configuration is secure enough or if it has exploitable weaknesses.

Generate a step-by-step response plan for a phishing attack based on these user reports: [insert user reports].

This is ideal when creating structured response procedures from unstructured data, allowing for methodical incident handling.

What are the best practices for preventing DDoS attacks in cloud environments?

In preparing preventative measures, you can ask the AI for insights based on the latest trends and expert recommendations.

Analyze the following attack pattern and suggest immediate mitigations: [insert attack pattern].

For this prompt, provide specific attack data to receive tailored mitigation strategies.

Weak vs Strong Prompt Examples

❌ Weak: Tell me about phishing.
βœ… Strong: What are the latest phishing tactics used against financial institutions and how can they be mitigated?
❌ Weak: Give me some tips.
βœ… Strong: Provide a checklist of immediate response actions for a ransomware threat detected in our network.

Advanced Prompt Techniques

Utilize advanced techniques for enhanced outputs. These include:

  • Role Prompting: Specify the role, such as a cybersecurity analyst or a threat hunter, to gain context-specific advice.
  • Chain-of-Thought: Break down complex requests into individual queries to facilitate clearer answers.
  • Few-Shot Examples: Provide several examples of the input-output structure you expect to guide the AI.
  • Output Formatting: Specify the preferred format for results, such as TABLE, BULLET POINTS, or NUMERICAL LIST.

Claude vs ChatGPT: Which Works Better For This

ChatGPT tends to excel in conversational context and nuanced discussions, while Claude is known for its accuracy and presentation style. For incident responses, using Claude might be more beneficial for generating clear and concise reports, whereas ChatGPT may serve better in brainstorming sessions for ideas and strategies.

Tips for Getting Consistent Results

  • Context Setting: Always frame your questions with sufficient background to improve response quality.
  • Specificity: The more specific your request, the more relevant the output will be.
  • Iterative Refinement: Use follow-up questions to drill down further into the topic or clarify answers.

Quick Reference: All Prompts in One Place

  • Summarize the incident details from the following log entries: [insert log entries].
  • Identify the potential vulnerabilities in the following system configuration: [insert system details].
  • Generate a step-by-step response plan for a phishing attack based on these user reports: [insert user reports].
  • What are the best practices for preventing DDoS attacks in cloud environments?
  • Analyze the following attack pattern and suggest immediate mitigations: [insert attack pattern].