Separate what the logs show from what you suspect

About this exercise

Write findings on this DNS and proxy data for the IR lead. Write exactly 4 numbered findings, each starting with the tag [Observed] (directly in the logs) or [Inference] (your reasoning), with at least one of each. Don't name an attacker group or malware family; nothing in the logs shows that. Plain text, under 110 words.

Common mistakes when you ask AI for this

• Mixing facts and guesses. The AI writes 'the host is infected with a backdoor' as if the logs proved it. Try: Say: "Tag each finding [Observed] or [Inference]."
• Repeating the chat theory. The AI picks up Nate's guess and names a group or malware. Try: Add: "Don't name an attacker group or malware family; the logs don't show one."
• A long write-up. The AI writes a full report with sections and recommendations. Try: Be exact: "Exactly 4 numbered findings, each under 22 words."
• Letting markdown in. AI adds bold and headings by default, and in the IR channel they show up as stray symbols. Try: Add: "Plain text only, no bold, no headings."

What a strong prompt includes

• Asks for observed vs inferred tags
• Bans attribution
• Says exactly how many
• Keeps it to the material
• Asks for plain text

Practice this now ↑

Related exercises

• Alert sales to a competitor's price change, facts only (Research & AI Search · Product managers)
• Answer a cyber insurance form honestly from your notes (Cybersecurity AI · Small business owners)
• Answer an employee's worried question about a breach rumor (Cybersecurity AI · Managers and team leads)
• Approve or return expense claims against the policy (Productivity AI · Finance and accounting)
• Approve part of an overtime request with the math (Writing AI · Managers and team leads)