{"id":"sec-it-dns-beacon-observed-vs-inference","audience":"it-security","category":"security","track":"security","technique":"verification","title":"Separate what the logs show from what you suspect","free":false,"task":"Write findings on this DNS and proxy data for the IR lead. Write exactly 4 numbered findings, each starting with the tag [Observed] (directly in the logs) or [Inference] (your reasoning), with at least one of each. Don't name an attacker group or malware family; nothing in the logs shows that. Plain text, under 110 words.","materialLabel":"Log excerpt and analyst chat (attached to your prompt automatically)","material":"DNS resolver log, host WS-ENG-22 (192.0.2.57), Nov 6, 2026\n14:00:02 query A cdn-update-check.example.top -> 203.0.113.200\n14:01:02 query A cdn-update-check.example.top -> 203.0.113.200\n14:02:03 query A cdn-update-check.example.top -> 203.0.113.200\n14:03:02 query A cdn-update-check.example.top -> 203.0.113.200\n14:04:02 query A cdn-update-check.example.top -> 203.0.113.200\n\nProxy log, same host\n14:00:03 POST https://cdn-update-check.example.top/api/v2/ping  sent 312 bytes  recv 48 bytes  status 200\n14:01:03 POST https://cdn-update-check.example.top/api/v2/ping  sent 312 bytes  recv 48 bytes  status 200\n14:02:04 POST https://cdn-update-check.example.top/api/v2/ping  sent 312 bytes  recv 48 bytes  status 200\n(same pattern continues every minute until 16:30)\n\nDomain lookup: cdn-update-check.example.top registered Nov 3, 2026 (3 days ago).\nSoftware inventory for WS-ENG-22: no installed product uses this domain.\n\n#ir-chat\n14:52 Nate: this looks exactly like that group from the news article last week, I bet it's their backdoor\n14:53 Priya: we don't have the process name yet, EDR data for WS-ENG-22 is still syncing","rules":[{"type":"numberedItems","count":4},{"type":"plainText"},{"type":"maxWords","max":110}],"mistakes":[{"title":"Mixing facts and guesses","why":"The AI writes 'the host is infected with a backdoor' as if the logs proved it.","fix":"Say: \"Tag each finding [Observed] or [Inference].\"","checks":["r0","r1"]},{"title":"Repeating the chat theory","why":"The AI picks up Nate's guess and names a group or malware.","fix":"Add: \"Don't name an attacker group or malware family; the logs don't show one.\"","checks":["r2"]},{"title":"A long write-up","why":"The AI writes a full report with sections and recommendations.","fix":"Be exact: \"Exactly 4 numbered findings, each under 22 words.\"","checks":["numberedItems","maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the IR channel they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Asks for observed vs inferred tags","patterns":["observed","inference","infer","tag"]},{"label":"Bans attribution","patterns":["attacker group","malware family","attribut","don'?t name","nate"]},{"label":"Says exactly how many","patterns":["\\b4\\b.{0,25}(finding|line|item)","exactly (4|four)"]},{"label":"Keeps it to the material","patterns":["only (use )?(the )?(facts|what|info|details)","don'?t (invent|make up|guess|add)","not in the","stick to","nothing (else|extra|outside)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"An IR lead needs to know which statements are proven. Ask the AI to tag every finding as observed or inferred, and keep guesses from the chat out.","rubricLabels":["Every numbered finding starts with exactly [Observed] or [Inference], and there is at least one of each","The [Observed] findings state only things in the data (for example the every-minute queries to cdn-update-check.example.top, 203.0.113.200, the 312-byte POSTs, the domain registered Nov 3, or no installed product using it)","Does not name a specific attacker group, malware family or process name, and does not present Nate's guess as fact (Inference lines worded as possibilities are fine)"]}