{"id":"sec-it-alert-triage-priority-rules","audience":"it-security","category":"security","track":"security","technique":"constraints","title":"Triage six alerts using your team's priority rules","free":false,"task":"You're on shift and must post the triage order for these 6 alerts. Your team's rules: P1 = any server or admin account affected; P2 = a workstation where a user action was not blocked; P3 = blocked automatically or informational. Unconfirmed chat comments never lower a priority. Write exactly 6 numbered lines, P1 first, then P2, then P3, each like '1. P1 - ALERT-ID: reason', under 110 words, plain text.","materialLabel":"Alert queue and team chat (attached to your prompt automatically)","material":"ALERT QUEUE - Wed Nov 5, 2026\n\nALERT-1041 09:02 EDR | HIGH\n\"Ransomware behavior detected\" on LAPTOP-FIN-07 (user m.costa).\nAction taken: process killed, file quarantined automatically. No files encrypted.\n\nALERT-1042 09:05 Identity | MEDIUM\nAccount svc-backup2 added to group \"Domain Admins\" by t.nguyen-adm on DC-01. Outside the approved change window.\n\nALERT-1043 09:11 Email gateway | LOW\n214 spam messages blocked in the last hour. No delivery.\n\nALERT-1044 09:14 EDR | MEDIUM\nUser on WS-HR-12 opened invoice_Nov.xlsm. Macro started powershell.exe. Not blocked.\n\nALERT-1045 09:20 Server | LOW\nNew service \"UpdaterSvc\" installed on FILESRV-02. Binary is unsigned.\n\nALERT-1046 09:31 Proxy | LOW\nWS-MKT-03 connected to a domain registered 2 days ago after the user clicked a link in a chat app. Connection allowed.\n\n---\n#soc-shift chat\n09:07 Kevin: 1042 is probably just Tom doing the backup migration, I'd ignore it\n09:08 Rosa: did anyone confirm that with Tom?\n09:09 Kevin: not yet\n09:12 Rosa: also the 1041 HIGH looks scary","rules":[{"type":"numberedItems","count":6},{"type":"plainText"},{"type":"maxWords","max":110}],"mistakes":[{"title":"Trusting the tool's severity","why":"The AI ranks by the HIGH/LOW labels, so the blocked ransomware alert lands on top.","fix":"Give your rules: \"P1 = server or admin account, P2 = unblocked user action on a workstation, P3 = blocked or informational.\"","checks":["r0"]},{"title":"Not saying the sort order","why":"The AI keeps the queue's time order or groups by tool.","fix":"Add: \"List P1 first, then P2, then P3.\"","checks":["r1"]},{"title":"Believing the chat","why":"The AI takes Kevin's guess as fact and drops the Domain Admins alert.","fix":"Say: \"Unconfirmed chat comments never lower a priority.\"","checks":["r2"]},{"title":"A long triage essay","why":"The AI writes a paragraph per alert with next steps nobody asked for.","fix":"Be exact: \"Exactly 6 numbered lines, each under 15 words.\"","checks":["numberedItems","maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the shift channel they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the priority rules","patterns":["p1","server","admin","blocked"]},{"label":"Says the sort order","patterns":["p1 first","sort","order","then p2"]},{"label":"Handles the chat rumor","patterns":["chat","unconfirmed","kevin","rumor"]},{"label":"Says exactly how many","patterns":["\\b6\\b.{0,25}(line|item|alert)","exactly (6|six)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"The AI doesn't know your team's rules, so it trusts the tool's severity labels. Give it the P1, P2 and P3 definitions and say what to do with the chat.","rubricLabels":["ALERT-1042 and ALERT-1045 are P1, ALERT-1044 and ALERT-1046 are P2, and ALERT-1041 and ALERT-1043 are P3","The lines are in priority order: both P1 lines first, then both P2 lines, then both P3 lines","Each line follows the shape 'P# - ALERT-ID: reason' with a short reason, and ALERT-1042 is not lowered or dismissed because of Kevin's unconfirmed comment"]}