🛠 Security Tool Cheatsheet
Alex Morgan — Senior Penetration Tester
Why AI Changes the Game for Incident Response
The landscape of cybersecurity incidents is constantly evolving, requiring a rapid and informed response to mitigate damage. AI tools like ChatGPT, Claude, and others can greatly enhance incident response processes by providing insights, suggestions, and automation capabilities.
Before You Start: How to Set Context Properly
When using AI for incident response, it’s crucial to provide context to get relevant responses. This can include specifying the type of incident, the systems involved, and the intended outcome of using the AI tool. Begin by setting clear boundaries for what you need from the AI.
Core Prompts Cheatsheet
What it does: Generates an outline of actionable steps to respond to phishing attacks.
When to use it: Right after discovering a phishing incident.
How to customize: Specify whether it involves internal training or technical countermeasures.
What it does: Retrieves specific IoCs for ransomware to enhance monitoring.
When to use it: Before starting network scanning or containment.
How to customize: Specify the ransomware family or time frame.
What it does: Creates a structured report format for documenting DDoS incidents.
When to use it: After resolving an incident to consolidate findings.
How to customize: Include specific metrics such as attack volume and duration.
What it does: Suggests methods for containing potential insider threats.
When to use it: During the identification phase of an insider threat situation.
How to customize: Specify whether it involves technical or human resources.
What it does: Summarizes GDPR or HIPAA requirements related to data breaches.
When to use it: When preparing for post-incident legal obligations.
How to customize: Specify regulations based on your jurisdiction.
What it does: Outlines steps for evaluating incident response performance.
When to use it: After an incident has been fully resolved.
How to customize: Include specific metrics to assess team performance.
What it does: Discusses preventive measures for endpoint security.
When to use it: During the architecture phase of IT planning.
How to customize: Specify the types of end-user environments.
What it does: Defines responsibilities for incident responders, IT staff, and management.
When to use it: When establishing or refining an incident response team.
How to customize: List specific roles with defined functions.
What it does: Compiles key takeaways from recent incidents to inform training.
When to use it: During training sessions or workshops.
How to customize: Request insights related to specific industries.
Weak vs Strong Prompt Examples
Advanced Prompt Techniques
1. Role Prompting: Set a specific role for the AI to adopt. For example, telling the AI to act as a security analyst can enhance the relevance of responses.
2. Chain-of-Thought: Guide the AI through multi-step processes for complex tasks. For example, “Explain how to identify and remediate vulnerabilities in a network, step by step.”
3. Few-Shot Learning: Provide the AI with examples of desirable outputs. For example, providing two sample response formats prior to asking a question can improve output quality.
4. Output Formatting: Specify how you want the information returned (e.g., bullet points, numbered lists) for better clarity.
Claude vs ChatGPT: Which Works Better For This
While both Claude and ChatGPT are powerful, the choice often depends on user preference and specific nuances in their responses. For example, Claude may generate more concise outputs, while ChatGPT might produce more detailed explanations. Testing both can help determine which aligns better with your needs.
Tips for Getting Consistent Results
1. Be Specific: The more context you provide, the more tailored the response.
2. Iterative Refinement: Don’t hesitate to refine prompts based on initial outcomes. Ask follow-up questions.
3. Contextual Setting: Reinforcing the situation or incident context can drastically improve relevance.
Quick Reference: All Prompts in One Place
- “As a cybersecurity incident responder, outline steps I should take to handle a Phishing attack targeting my employees.”
- “List indicators of compromise (IoCs) associated with recent ransomware variants.”
- “Draft an incident report for a DDoS attack, including the timeline and impact assessment.”
- “What are effective containment strategies for a suspected insider threat?”
- “Provide a summary of compliance requirements for handling personal data in cybersecurity incidents.”
- “Generate a checklist for conducting a post-incident review after a data breach.”
- “What are the best practices for securing endpoints against malware threats?”
- “Clarify the roles of various stakeholders during a cybersecurity incident response.”
- “Summarize lessons learned from the latest high-profile cyber incidents for training purposes.”