AI Prompts Cheatsheet for Incident Response

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

Why AI Changes the Game for Incident Response

Incident response teams are under constant pressure to quickly analyze security incidents, determine the root cause, and mitigate potential threats. AI tools like ChatGPT and Claude can help streamline these processes, offering insights, automation, and refined decision-making capabilities that enhance the overall efficiency of the incident response lifecycle.

Before You Start: How to Set Context Properly

To get the best results from AI tools, always set clear context. Define the scenario, specify your needs, and provide relevant information about the incident. This helps the AI focus on exactly what you’re interested in without unnecessary information.

Core Prompts Cheatsheet

This prompt requests detailed information about malware infection scenarios, which can guide IR actions.

Use this prompt when needing immediate actions to limit damage post-infection.

Ideal for establishing documentation consistency, ensuring all critical details are captured.

This prompt ensures your team is prepared by understanding DDoS signatures and mitigations.

Use this to gain insights that reinforce the team’s understanding of containment strategies.

This prompt helps in outlining a consistent analytical approach during investigations.

Useful for identifying the right resources to employ during active investigations.

Awareness of legal implications can help navigate potential risks effectively.

Weak vs Strong Prompt Examples

Advanced Prompt Techniques

Enhance your prompts by using techniques like:

• Role Prompting: Instruct the AI to adopt a specific role, e.g., “Act as a cybersecurity analyst…”
• Chain-of-Thought: Encourage the AI to think step-by-step, clarifying processes or methodologies.
• Few-Shot Examples: Provide examples of what you’re looking for, so the AI understands the format and depth required.
• Output Formatting: Specify how you want the results structured (e.g., bullet points, tables).

Claude vs ChatGPT: Which Works Better For This

While both ChatGPT and Claude can be effective in incident response scenarios, ChatGPT often excels in providing detailed and nuanced responses. Claude may be more conversational but can sometimes lack specificity. Testing both with similar prompts can help determine which fits your needs best for specific tasks.

Tips for Getting Consistent Results

To consistently yield strong outputs, consider:

• Context Setting: Always begin with a clear statement of context.
• Specificity: Narrow down the focus of your prompts.
• Iterative Refinement: Don’t hesitate to clarify or modify prompts based on initial responses.

Quick Reference: All Prompts in One Place

1. Describe a potential malware infection scenario.
2. List the steps to isolate a compromised endpoint.
3. Generate a report template for documenting incidents.
4. Identify signs of a DDoS attack and response strategies.
5. Explain the importance of containment in incident response.
6. Detail a forensic analysis process for an infected system.
7. Suggest tools for network traffic analysis.
8. Discuss legal considerations during incidents.