{"id":"sec-it-incident-engineer-timeline","audience":"it-security","category":"security","track":"security","technique":"format","title":"Turn chat logs into a clean incident timeline for engineers","free":false,"task":"Engineers need a clean timeline of INC-2291 for the postmortem. Write exactly 6 numbered lines like '1. 22:40 - who - what happened', in time order, keeping hostnames, accounts and IPs exactly as written. Use the corrected facts where a later message fixes an earlier one, and leave out chatter. Plain text, under 130 words.","materialLabel":"Incident channel export (attached to your prompt automatically)","material":"#inc-2291 channel export (Nov 4-5, 2026)\n\n[23:12] Dev: ok so login to the marketing share at 22:40 from 198.51.100.77, account m.coordinator\n[23:13] Dev: pretty sure they got 40k customer records, that share is huge\n[23:14] Lena: don't say that yet please\n[22:55] (pinned by Dev, posted late) password for m.coordinator found in a third-party breach list, no MFA enrolled\n[23:25] Dev: disabled m.coordinator, revoked sessions, blocked 198.51.100.77 at fw-edge-01\n[23:40] Sam: anyone want pizza\n[00:30] Lena: checked other systems, no other logins from that IP or account\n[01:15] Lena: CORRECTION: file access logs show only the marketing share was opened, brand assets and event photos only. No customer records live there. Ignore the 40k number.\n[02:00] Dev: forced MFA enrollment for the 37 accounts without it\n[02:05] Sam: nice work all","rules":[{"type":"numberedItems","count":6},{"type":"plainText"},{"type":"maxWords","max":130}],"mistakes":[{"title":"Keeping the chat order","why":"The AI copies messages in the order they were posted, so the late 22:55 note ends up out of place.","fix":"Say: \"Sort by event time, not posting order.\"","checks":["r0"]},{"title":"Using the scary first guess","why":"The AI includes the 40k records claim that was corrected later.","fix":"Add: \"Use the corrected facts; the 40k number was wrong.\"","checks":["r2"]},{"title":"Paraphrasing technical details","why":"The AI writes 'the attacker's IP' instead of the exact address engineers search for.","fix":"Ask: \"Keep hostnames, accounts and IPs exactly as written.\"","checks":["r1"]},{"title":"No fixed shape","why":"The AI writes a narrative or a table.","fix":"Show it: \"Exactly 6 lines: time - who - what happened.\"","checks":["numberedItems","r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 130 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 100 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the postmortem doc they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Asks for time order","patterns":["time order","chronolog","sort","by time"]},{"label":"Keeps details exact","patterns":["exact","as written","hostname","ip"]},{"label":"Uses the corrections","patterns":["correct","40k","later message"]},{"label":"Says exactly how many","patterns":["\\b6\\b.{0,25}(line|event|item)","exactly (6|six)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Chat exports are out of order and full of guesses. Tell the AI to sort by event time, keep technical details exact, and use the corrections.","rubricLabels":["The 6 lines are in time order: 22:40 login, 22:55 breach-list password and no MFA, 23:25 containment, 00:30 no other logins, 01:15 only marketing share opened, 02:00 MFA enrollment for 37 accounts","Keeps m.coordinator, 198.51.100.77 and fw-edge-01 exactly as written","Every line follows 'time - who - what happened', does not say 40k customer records were taken, and leaves out the pizza and 'nice work' chatter"]}