Library › Cybersecurity AI › IT and security teams

Close an EDR alert with a verdict and evidence

  • For IT and security teams
  • You practice Asking for a format you can use
  • Time about 5 minutes

About this exercise

Close out this EDR alert in the ticket. First line: 'Verdict: True positive', 'Verdict: False positive' or 'Verdict: Needs more data'. Then exactly 3 bullets, each citing one piece of evidence from the alert or notes. Last line: 'Action:' with the one next step. Plain text, under 80 words.

Common mistakes when you ask AI for this

  • Hedging the verdict. The AI says 'likely benign but further investigation recommended' instead of a clear call. Try: Give the choices: "First line: Verdict: True positive, False positive or Needs more data."
  • Evidence without specifics. The AI says 'the process appears legitimate' without saying why. Try: Ask: "3 bullets, each citing one piece of evidence from the alert or notes."
  • Default incident steps. The AI recommends isolating and reimaging the PC, which the evidence doesn't support. Try: Say: "End with Action: the one next step that fits the verdict."
  • Trusting the AI to count words. AI is bad at counting. Ask for "under 80 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 60 words total."
  • Letting markdown in. AI adds bold and headings by default, and in the ticket they show up as stray symbols. Try: Add: "Plain text only, no bold, no headings."

What a strong prompt includes

  • Asks for a fixed verdict
  • Asks for evidence
  • Asks for one next step
  • Limits the bullets
  • Asks for plain text

Practice this now ↑

Related exercises