Library › Cybersecurity AI › IT and security teams

Turn chat logs into a clean incident timeline for engineers

  • For IT and security teams
  • You practice Asking for a format you can use
  • Time about 5 minutes

About this exercise

Engineers need a clean timeline of INC-2291 for the postmortem. Write exactly 6 numbered lines like '1. 22:40 - who - what happened', in time order, keeping hostnames, accounts and IPs exactly as written. Use the corrected facts where a later message fixes an earlier one, and leave out chatter. Plain text, under 130 words.

Common mistakes when you ask AI for this

  • Keeping the chat order. The AI copies messages in the order they were posted, so the late 22:55 note ends up out of place. Try: Say: "Sort by event time, not posting order."
  • Using the scary first guess. The AI includes the 40k records claim that was corrected later. Try: Add: "Use the corrected facts; the 40k number was wrong."
  • Paraphrasing technical details. The AI writes 'the attacker's IP' instead of the exact address engineers search for. Try: Ask: "Keep hostnames, accounts and IPs exactly as written."
  • No fixed shape. The AI writes a narrative or a table. Try: Show it: "Exactly 6 lines: time - who - what happened."
  • Trusting the AI to count words. AI is bad at counting. Ask for "under 130 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 100 words total."
  • Letting markdown in. AI adds bold and headings by default, and in the postmortem doc they show up as stray symbols. Try: Add: "Plain text only, no bold, no headings."

What a strong prompt includes

  • Asks for time order
  • Keeps details exact
  • Uses the corrections
  • Says exactly how many
  • Asks for plain text

Practice this now ↑

Related exercises