Library › Cybersecurity AI › IT and security teams

Fill the incident report template from raw notes

Practice: Asking for a format you can use. About 5 minutes.

About this exercise

Write the incident report for INC-3307 in your team's template: exactly 6 numbered lines labeled Incident ID, Detected, Root cause, Impact, Actions taken, Open items. 'Detected' is when the alert fired, not when the activity began. Root cause must be the confirmed finding, not an early guess. Plain text, under 140 words.

Common mistakes when you ask AI for this

  • No template. The AI invents its own sections like Executive Summary and Lessons Learned. Try: Give the labels: "Exactly 6 numbered lines: Incident ID, Detected, Root cause, Impact, Actions taken, Open items."
  • Mixing up the times. The AI picks the first time it sees in the notes as the detection time. Try: Define it: "Detected = when the alert fired, not when activity began."
  • Repeating the early guess. The AI mentions the intern theory or blends it with the real cause. Try: Say: "Root cause is the confirmed finding only. Skip guesses and unrelated notes."
  • Trusting the AI to count words. AI is bad at counting. Ask for "under 140 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 110 words total."
  • Letting markdown in. AI adds bold and headings by default, and in the incident tracker they show up as stray symbols. Try: Add: "Plain text only, no bold, no headings."

What a strong prompt includes

  • Gives the template labels
  • Defines the detection time
  • Uses only confirmed facts
  • Says exactly how many
  • Asks for plain text

Practice this now ↑

Related exercises