{"id":"sec-it-edr-false-positive-verdict","audience":"it-security","category":"security","track":"security","technique":"format","title":"Close an EDR alert with a verdict and evidence","free":false,"task":"Close out this EDR alert in the ticket. First line: 'Verdict: True positive', 'Verdict: False positive' or 'Verdict: Needs more data'. Then exactly 3 bullets, each citing one piece of evidence from the alert or notes. Last line: 'Action:' with the one next step. Plain text, under 80 words.","materialLabel":"EDR alert and analyst notes (attached to your prompt automatically)","material":"EDR ALERT-4471 | Severity: High | Nov 6, 2026 03:00:12\nHost: WS-ACC-09 (Accounting)\nRule: \"Suspicious PowerShell - encoded command\"\nProcess: powershell.exe -EncodedCommand SQBuAHYAZQBuAHQAbwByAHkA...\nParent: C:\\Program Files\\Harborline\\InventoryAgent\\agent.exe\nSigner of parent: Harborline IT Code Signing (valid)\nUser: SYSTEM\nNetwork: connection to inventory.harborline.example.com (internal, 192.0.2.80)\n\nAnalyst notes (Rui):\n- The inventory agent is our own tool. It runs every night at 03:00 on all accounting PCs. The schedule is in the IT wiki.\n- Decoded the command: it reads the installed software list and sends it to the inventory server.\n- Same alert fired on WS-ACC-03 and WS-ACC-11 at 03:00 tonight. Same parent, same command.\n- The agent was updated yesterday to v5, and the new version uses encoded commands. The old version didn't.\n- No other alerts on WS-ACC-09 in 30 days.","rules":[{"type":"plainText"},{"type":"maxBullets","max":3},{"type":"maxWords","max":80}],"mistakes":[{"title":"Hedging the verdict","why":"The AI says 'likely benign but further investigation recommended' instead of a clear call.","fix":"Give the choices: \"First line: Verdict: True positive, False positive or Needs more data.\"","checks":["r0"]},{"title":"Evidence without specifics","why":"The AI says 'the process appears legitimate' without saying why.","fix":"Ask: \"3 bullets, each citing one piece of evidence from the alert or notes.\"","checks":["r1","maxBullets"]},{"title":"Default incident steps","why":"The AI recommends isolating and reimaging the PC, which the evidence doesn't support.","fix":"Say: \"End with Action: the one next step that fits the verdict.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 80 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 60 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the ticket they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Asks for a fixed verdict","patterns":["verdict","false positive","true positive"]},{"label":"Asks for evidence","patterns":["evidence","cite","proof","why"]},{"label":"Asks for one next step","patterns":["action","next step","one step"]},{"label":"Limits the bullets","patterns":["\\b(3|three)\\b.{0,15}bullet","bullet.{0,20}\\b(3|three)\\b"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"A ticket close-out needs a clear call that someone else can check. Give the verdict options, ask for evidence bullets, and a single next step.","rubricLabels":["The first line is exactly 'Verdict: False positive'","There are 3 bullets, each citing a specific piece of evidence (for example the signed parent agent.exe, the nightly 03:00 schedule, the decoded command reading the software list, the v5 update, or the same alert on other accounting PCs)","The last line starts 'Action:' and gives one next step such as tuning or excluding the rule for the signed v5 inventory agent; it does not recommend isolating or reimaging the PC"]}