Library › Cybersecurity AI › IT and security teams

Triage six alerts using your team's priority rules

Practice: Setting limits and rules. About 5 minutes.

About this exercise

You're on shift and must post the triage order for these 6 alerts. Your team's rules: P1 = any server or admin account affected; P2 = a workstation where a user action was not blocked; P3 = blocked automatically or informational. Unconfirmed chat comments never lower a priority. Write exactly 6 numbered lines, P1 first, then P2, then P3, each like '1. P1 - ALERT-ID: reason', under 110 words, plain text.

Common mistakes when you ask AI for this

  • Trusting the tool's severity. The AI ranks by the HIGH/LOW labels, so the blocked ransomware alert lands on top. Try: Give your rules: "P1 = server or admin account, P2 = unblocked user action on a workstation, P3 = blocked or informational."
  • Not saying the sort order. The AI keeps the queue's time order or groups by tool. Try: Add: "List P1 first, then P2, then P3."
  • Believing the chat. The AI takes Kevin's guess as fact and drops the Domain Admins alert. Try: Say: "Unconfirmed chat comments never lower a priority."
  • A long triage essay. The AI writes a paragraph per alert with next steps nobody asked for. Try: Be exact: "Exactly 6 numbered lines, each under 15 words."
  • Letting markdown in. AI adds bold and headings by default, and in the shift channel they show up as stray symbols. Try: Add: "Plain text only, no bold, no headings."

What a strong prompt includes

  • Gives the priority rules
  • Says the sort order
  • Handles the chat rumor
  • Says exactly how many
  • Asks for plain text

Practice this now ↑

Related exercises