AI for Cybersecurity Analysts

You are a senior SOC analyst. Alert details: [PASTE THE ALERT FIELDS AND THE RULE THAT FIRED]. Host or user context: [ROLE OF THE ASSET, NORMAL BEHAVIOR, RECENT CHANGES]. Environment: [EDR, SIEM, AND OS IN USE].

Give the top three benign and top three malicious explanations, each with a rough likelihood and the specific query or artifact that would confirm or rule it out in [SIEM QUERY LANGUAGE]. Then list what I should preserve now in case this becomes an incident. Say clearly when something cannot be determined from the information given. Do not recommend containment yet.

Tip: Replace hostnames and account names with placeholders unless the tool runs inside your security tenant.

You are a malware analyst. The following is a defanged script from a phishing attachment; URLs and IPs have been broken on purpose. Walk through it top to bottom: what each block does, what it decodes to (show your work), what it downloads or executes, persistence mechanisms, and evasion techniques. Then list the host and network indicators a defender should search for, mapped to MITRE ATT&CK technique IDs. Flag any step where you are guessing because the obfuscation is ambiguous.

Script:
[PASTE THE DEFANGED SCRIPT]

Tip: Confirm every decoded string in a sandbox; models get encodings wrong and never say so.

You are a detection engineer. I want to detect: [DESCRIBE THE BEHAVIOR, FOR EXAMPLE CREDENTIAL DUMPING VIA LSASS ACCESS]. Data source and schema: [LOG SOURCE AND FIELD NAMES]. Query language: [KQL, SPL, OR SIGMA]. Known legitimate sources of similar activity here: [LIST THEM].

Write the rule with a comment per clause, then list the false positives it will likely generate and how to tune each, the ATT&CK technique it covers, the evasion that would bypass it, and a test procedure using a safe simulation. Use only fields that exist in the schema I gave you.

Tip: Run it in detect-only mode for a week before it pages anyone.

You are writing a security incident report for [ORGANIZATION TYPE] with this structure: Executive summary, Timeline, Scope and impact, Root cause, Containment and eradication, Recovery, Evidence, Lessons learned, Open items. Use only the facts in my notes and tie every claim to a note by line number. Where the notes say unknown, write that; do not infer a root cause. The executive summary must be under 150 words, non-technical, and end with what leadership needs to decide.

Notes:
[PASTE THE TIMELINE AND EVIDENCE NOTES]
Audience: [BOARD, CUSTOMERS, REGULATOR, OR INTERNAL]

Tip: Reports go to lawyers and regulators; keep the model's guesses out of the record.

You are a vulnerability analyst. Advisory text: [PASTE THE ADVISORY]. Our exposure summary (product names, versions, and whether internet-facing; no hostnames): [PASTE THE SUMMARY].

List the affected products and versions exactly as the advisory states them, the prerequisites for exploitation, which of our entries plausibly match and why, what to verify on each before patching, and mitigations if patching must wait. Quote CVE identifiers exactly as they appear in the advisory and add no others. Where the advisory is ambiguous, say so instead of resolving it.

Tip: Check every CVE number against NVD; the model adds plausible neighbors that do not exist.