Library › Cybersecurity AI › IT and security teams

Explain Windows security events using the reference table

  • For IT and security teams
  • You practice Keeping the AI to your sources
  • Time about 5 minutes

About this exercise

A help desk tech asked what these 5 Windows events mean. Explain each in one numbered line, using the event reference table and the context notes only, ending with 'Routine' or 'Review'. Review = anything the context notes don't explain. Plain text, under 110 words.

Common mistakes when you ask AI for this

  • Explaining from memory. The AI describes event IDs in general and misses what's normal for this server. Try: Say: "Use the reference table and context notes only."
  • No clear call. The AI says 'could be suspicious' about everything. Try: Add: "End each line with Routine or Review. Review = not explained by the notes."
  • Jumping to conclusions. The AI calls the new admin account an attack. Try: Ask: "Say what happened and that there's no ticket. Don't guess who."
  • Grouping events. The AI merges related events into one paragraph. Try: Be exact: "One numbered line per event, exactly 5."
  • Trusting the AI to count words. AI is bad at counting. Ask for "under 110 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 85 words total."
  • Letting markdown in. AI adds bold and headings by default, and in the help desk chat they show up as stray symbols. Try: Add: "Plain text only, no bold, no headings."

What a strong prompt includes

  • Uses the reference table
  • Gives the labels
  • Defines Review
  • Says exactly how many
  • Asks for plain text

Practice this now ↑

Related exercises