# The Incident Report Builder A prompt sequence that takes raw alert data, log excerpts, and timeline notes and turns them into a structured security incident report. No invented findings. No filled-in gaps. Realistic time estimate: 20 to 40 minutes for a contained incident with clean inputs. Longer if your logs are scattered or the timeline has gaps you still need to verify. --- ## Handling and Honesty Note Before you paste anything into an AI tool, do this: - Redact credentials, API keys, passwords, and session tokens. - Redact customer names, emails, and any PII. - Paste only artifacts from systems you own or are authorized to work on. The AI must never invent a CVE number, an indicator of compromise, a log line, or a finding. If it does, that output is wrong and you cut it. You verify every artifact in this report against your own tools and authoritative sources before the report leaves your hands. --- ## Step 1: Gather the Inputs Collect these before you run any prompt. The output is only as good as what you bring in. - The raw alert: source system, alert name, severity, timestamp, and the trigger condition. - Relevant log excerpts: authentication logs, firewall logs, EDR telemetry, or whatever your stack captured. Copy the actual lines. - Your observed timeline: what you saw, when you saw it, in plain chronological order. Include gaps. - Affected assets: hostnames, IPs, accounts, services. List only what you can confirm from your data. - Actions already taken: any containment, isolation, or remediation steps you have already executed. Paste these into a working document before you move to Step 2. --- ## Step 2: Timeline and Scope Prompt This prompt takes your raw inputs and produces an ordered timeline and a scoped impact statement. Gaps stay gaps. ``` You are a security analyst assistant. I will give you raw incident inputs. Your job is to reconstruct an ordered timeline and write a scoped impact statement. Rules: - Use only the information I provide. Do not add facts, context, or assumptions. - If a time or event is unclear or missing, mark it [UNCONFIRMED] in the timeline. - Do not invent log lines, CVE numbers, IP addresses, or indicators of compromise. - Do not speculate about threat actor identity or motive. Here are my inputs: Alert details: [PASTE ALERT DETAILS HERE] Log excerpts: [PASTE RELEVANT LOG LINES HERE] Observed timeline (my notes): [PASTE YOUR TIMELINE NOTES HERE] Affected assets: [LIST HOSTNAMES, IPs, ACCOUNTS, SERVICES] Actions already taken: [LIST CONTAINMENT OR REMEDIATION STEPS ALREADY EXECUTED] Produce: 1. An ordered timeline from first indicator to current status. Mark any gap [UNCONFIRMED]. 2. A scope and impact statement: what systems and data are confirmed affected, what is suspected but unconfirmed, and what is confirmed not affected. ``` Review the output. Correct any [UNCONFIRMED] items you can resolve with your tools before moving to Step 3. --- ## Step 3: Report Draft Prompt This prompt takes the verified timeline and scope from Step 2 and produces a full structured incident report. Do not skip the review step before running this. ``` You are a security analyst assistant. I will give you a verified incident timeline and scope statement. Produce a structured security incident report. Rules: - Use only the information I provide. Do not add facts, context, or assumptions. - Do not invent CVE numbers, indicators of compromise, log lines, or findings. - If a section cannot be completed from the data I provide, write "Insufficient data" for that section. Do not fill it in. - Write in plain, direct language. No jargon that obscures meaning. Incident inputs: Timeline (verified, with [UNCONFIRMED] markers): [PASTE VERIFIED TIMELINE FROM STEP 2] Scope and impact statement: [PASTE SCOPE STATEMENT FROM STEP 2] Indicators observed (from my logs and tools only): [LIST IOCs: IPs, HASHES, DOMAINS, ACCOUNT NAMES, ETC.] Containment and remediation actions taken: [LIST ACTIONS WITH TIMESTAMPS IF AVAILABLE] Open items: [LIST WHAT IS STILL UNRESOLVED OR UNDER INVESTIGATION] Produce a structured report with these sections: 1. Executive Summary (3 to 5 sentences: what happened, what was affected, current status) 2. Timeline (from Step 2 output, ordered, [UNCONFIRMED] markers preserved) 3. Scope and Impact (from Step 2 output) 4. Indicators Observed (only what I listed above) 5. Containment and Remediation Actions 6. Open Items ``` --- ## Step 4: Communications Prompt This prompt produces a short, non-technical notice for users or stakeholders. It is derived from the report draft, not from raw inputs. ``` You are a security analyst assistant. I will give you a security incident report. Produce a short, non-technical notice for [USERS / STAKEHOLDERS / CUSTOMERS]. Rules: - Use only the information in the report. Do not add details or speculation. - Do not include technical indicators, log data, or internal system names. - Do not include any credentials, PII, or internal IP addresses. - Write at a plain reading level. Short sentences. No jargon. - Tone: direct and factual. Not alarming. Not minimizing. Incident report: [PASTE REPORT DRAFT FROM STEP 3] Audience: [DESCRIBE THE AUDIENCE: e.g., "employees who use the affected system" or "executive leadership"] Produce: - A subject line. - A notice of 150 words or fewer covering: what happened, who is affected, what action the audience needs to take (if any), and current status. ``` --- ## Final Verification Pass Before this report is shared with anyone, check every item on this list. - Every IOC in Section 4 is confirmed real and traced back to your own log data or tool output. - No CVE number appears in the report unless you verified it against NVD or the relevant vendor advisory. - No log line, hostname, or IP was generated by the AI. Every artifact in the report came from your systems. - The impact statement in Section 3 is supported by evidence you can point to. Remove anything that is not. - All credentials, API keys, passwords, and session tokens are redacted. - All customer PII is redacted. - The communications notice in Step 4 contains no internal system names, internal IPs, or technical indicators. If anything fails this check, fix it before the report leaves your hands. --- Part of The IT & Cybersecurity Library at vetslearn.com/libraries/it-cyber