{"id":"sec-it-windows-events-decode","audience":"it-security","category":"security","track":"security","technique":"grounding","title":"Explain Windows security events using the reference table","free":false,"task":"A help desk tech asked what these 5 Windows events mean. Explain each in one numbered line, using the event reference table and the context notes only, ending with 'Routine' or 'Review'. Review = anything the context notes don't explain. Plain text, under 110 words.","materialLabel":"Event excerpt, reference table and notes (attached to your prompt automatically)","material":"Security log excerpt - FILESRV-02, Nov 6, 2026\n1. 08:01:12  4624  Logon success  Account: svc-backup  Logon type: 5\n2. 08:14:40  4625  Logon failure  Account: j.ito  Logon type: 3  Reason: bad password\n3. 08:14:52  4624  Logon success  Account: j.ito  Logon type: 3\n4. 09:02:05  4720  User account created  New account: helpdesk-temp  Created by: a.reyes-adm\n5. 09:02:31  4732  Member added to security group  Member: helpdesk-temp  Group: Administrators  By: a.reyes-adm\n\nReference table (from our SOC wiki):\n4624 = successful logon. Type 3 = over the network (file share). Type 5 = a service started.\n4625 = failed logon.\n4720 = a user account was created.\n4732 = a member was added to a local security group.\n\nContext notes:\n- svc-backup is our backup service; it starts every day at 08:00.\n- j.ito mistypes her password most mornings (help desk ticket history).\n- No change ticket exists for an account called helpdesk-temp.\n- a.reyes-adm is a real admin account (Alex Reyes, IT).","rules":[{"type":"numberedItems","count":5},{"type":"plainText"},{"type":"maxWords","max":110}],"mistakes":[{"title":"Explaining from memory","why":"The AI describes event IDs in general and misses what's normal for this server.","fix":"Say: \"Use the reference table and context notes only.\"","checks":["r2"]},{"title":"No clear call","why":"The AI says 'could be suspicious' about everything.","fix":"Add: \"End each line with Routine or Review. Review = not explained by the notes.\"","checks":["r0"]},{"title":"Jumping to conclusions","why":"The AI calls the new admin account an attack.","fix":"Ask: \"Say what happened and that there's no ticket. Don't guess who.\"","checks":["r1","r2"]},{"title":"Grouping events","why":"The AI merges related events into one paragraph.","fix":"Be exact: \"One numbered line per event, exactly 5.\"","checks":["numberedItems"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 110 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 85 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the help desk chat they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Uses the reference table","patterns":["reference","table","wiki","context notes"]},{"label":"Gives the labels","patterns":["routine","review"]},{"label":"Defines Review","patterns":["review (=|means)","not explain","no (change )?ticket"]},{"label":"Says exactly how many","patterns":["\\b5\\b.{0,25}(line|event|item)","exactly (5|five)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"The same event can be normal on one server and alarming on another. Give the AI your reference table and notes, and a clear rule for when to flag.","rubricLabels":["Events 1, 2 and 3 end with 'Routine' and events 4 and 5 end with 'Review'","Events 4 and 5 explain that helpdesk-temp was created and added to the Administrators group by a.reyes-adm, and at least one of them says there is no change ticket","Explanations use the reference table's meanings (for example type 3 = network logon to the file share, type 5 = service start) and do not claim the account was compromised or name an attacker"]}