{"id":"sec-it-incident-report-template","audience":"it-security","category":"security","track":"security","technique":"format","title":"Fill the incident report template from raw notes","free":false,"task":"Write the incident report for INC-3307 in your team's template: exactly 6 numbered lines labeled Incident ID, Detected, Root cause, Impact, Actions taken, Open items. 'Detected' is when the alert fired, not when the activity began. Root cause must be the confirmed finding, not an early guess. Plain text, under 140 words.","materialLabel":"Responder notes (attached to your prompt automatically)","material":"INC-3307 - responder notes (Tomás, Nov 2-3, 2026)\n\n- Sign-in logs later showed the first bad login to vpn account k.wright at Nov 2, 19:48, from 203.0.113.90.\n- Our identity alert fired at Nov 2, 21:15: \"impossible travel\" for k.wright.\n- 21:20 Early guess from Jess on the call: \"probably the intern's laptop has malware, it's always the intern.\"\n- 21:30 Disabled k.wright, reset password, revoked VPN sessions.\n- 22:10 Laptop scan of k.wright's machine: clean.\n- Nov 3, 09:40 CONFIRMED: k.wright's password was reused from a 2025 breach of a third-party shopping site (found in a public breach list). The VPN did not require MFA for this account because it was in an old exception group.\n- Attacker browsed two internal wiki pages (team calendar, office seating chart). No downloads in the proxy logs. No other accounts used.\n- Removed the old MFA exception group (11 accounts) on Nov 3.\n- Still to do: confirm with HR that k.wright has finished password manager training; decide whether to force a reset for the 11 accounts that were in the exception group.\n- Coffee machine on floor 3 broken again, someone call facilities.","rules":[{"type":"numberedItems","count":6},{"type":"plainText"},{"type":"maxWords","max":140}],"mistakes":[{"title":"No template","why":"The AI invents its own sections like Executive Summary and Lessons Learned.","fix":"Give the labels: \"Exactly 6 numbered lines: Incident ID, Detected, Root cause, Impact, Actions taken, Open items.\"","checks":["r0","numberedItems"]},{"title":"Mixing up the times","why":"The AI picks the first time it sees in the notes as the detection time.","fix":"Define it: \"Detected = when the alert fired, not when activity began.\"","checks":["r1"]},{"title":"Repeating the early guess","why":"The AI mentions the intern theory or blends it with the real cause.","fix":"Say: \"Root cause is the confirmed finding only. Skip guesses and unrelated notes.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 140 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 110 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the incident tracker they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the template labels","patterns":["root cause","open items","actions taken","template"]},{"label":"Defines the detection time","patterns":["alert (fired|time)","detected","21:15"]},{"label":"Uses only confirmed facts","patterns":["confirm","not (the |an )?(early )?guess","speculat","only"]},{"label":"Says exactly how many","patterns":["\\b6\\b.{0,25}(line|item|field)","exactly (6|six)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Reports get compared across incidents, so the template matters. Name the 6 fields, define 'Detected', and tell the AI to ignore early guesses.","rubricLabels":["The 6 numbered lines are labeled Incident ID, Detected, Root cause, Impact, Actions taken, Open items, in that order, and Incident ID is INC-3307","Detected gives Nov 2, 21:15 (the alert time), not 19:48","Root cause is the reused password from a third-party breach plus no MFA because of the old exception group, does not blame the intern or malware, and the report leaves out the coffee machine"]}