Library › Cybersecurity AI › IT and security teams

Document a detection rule in your team's template

  • For IT and security teams
  • You practice Asking for a format you can use
  • Time about 5 minutes

About this exercise

Document the new detection rule from the analyst's notes in your team's template: exactly 5 numbered lines labeled Name, Logic, Why it matters, Known false positives, Response. Name must follow the convention 'ID-category-short-name' like 'DR-104-identity-...'. Your team maps High to Sev2, and Response must end with 'Severity: Sev2'. Use only the notes. Plain text, under 120 words.

Common mistakes when you ask AI for this

  • Ignoring the naming rule. The AI invents a friendly name or uses the joke. Try: Say: "Name format: DR-104-identity-short-name."
  • Vague logic. The AI says 'detects suspicious forwarding' and drops the 60-minute window. Try: Ask: "Logic: the exact condition and time window from the notes."
  • Missing false positives. The AI says 'some legitimate activity may trigger'. Try: Add: "List the known false positives from the notes."
  • No template. The AI writes a design doc. Try: Give the fields: "Exactly 5 numbered lines: Name, Logic, Why it matters, Known false positives, Response."
  • Trusting the AI to count words. AI is bad at counting. Ask for "under 120 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 95 words total."
  • Letting markdown in. AI adds bold and headings by default, and in the rule catalog they show up as stray symbols. Try: Add: "Plain text only, no bold, no headings."

What a strong prompt includes

  • Gives the template fields
  • Gives the naming rule
  • Says exactly how many
  • Keeps it to the material
  • Asks for plain text

Practice this now ↑

Related exercises