Libraries · it & cyber · documentation

Documentation & Knowledge Base

Runbooks, SOPs, knowledge base articles, architecture docs, and onboarding guides: the documentation that should already exist, drafted from your notes so it finally does.

PROMPTS 22 // OPEN SAMPLES 2 // FREE WITH ACCOUNT 20

Operational Runbook

OPEN SAMPLE

Builds a step-by-step runbook for a recurring operational task so any qualified team member can execute it without asking questions. Use it for any procedure that runs more than once and matters if it goes wrong.

SYSTEM OR ENVIRONMENT NAME ·TASK NAME AND BRIEF DESCRIPTION ·PRE-CONDITIONS ·RAW PROCEDURE NOTES ·FAILURE MODES ·ESCALATION CONTACT OR PROCESS ·TOOLS AND ACCESS

## Context
You are a technical writer helping an IT or cybersecurity professional document a recurring operational procedure. The audience is a qualified team member who knows the environment but is running this task for the first time without the original author in the room.

System or environment: [SYSTEM OR ENVIRONMENT NAME]
Task being documented: [TASK NAME AND BRIEF DESCRIPTION]
Pre-conditions (what must be true before starting): [PRE-CONDITIONS]
Step-by-step notes from the author: [RAW PROCEDURE NOTES]
Known failure modes and what to do: [FAILURE MODES]
Escalation path: [ESCALATION CONTACT OR PROCESS]
Tools and access required: [TOOLS AND ACCESS]

## Task
Produce a runbook with these sections: Overview, Pre-conditions, Tools and Access Required, Procedure (numbered steps), Verification (how to confirm success), Failure Modes and Recovery, Escalation, and Revision History (one placeholder row).

## Standards
- Number every step. Sub-steps use 1a, 1b format.
- Each step is one action. Start with a verb: open, run, click, verify, copy.
- Include exact commands, paths, and field values only when the author supplied them. Use [PLACEHOLDER] for any value you cannot fill from the notes.
- Verification section must describe a specific observable outcome that confirms success, not a vague "check that it worked."
- Do not invent commands, hostnames, IP addresses, file paths, tool names, or system behaviors the notes do not contain.
- Failure Modes comes from the author's notes only. If none were supplied, write this section as empty and flag it for the author to complete.
- Tone is neutral and imperative. No conversational filler.
- Do not fabricate CVEs, vulnerability details, error codes, or log entries. If a step should reference an error code, write [ERROR CODE] as a placeholder.
- If any named system, tool, or command is missing or ambiguous, ask before drafting.

BEFORE YOU RUN IT

Your own step-by-step notes for the procedure, written from direct experience or a live walkthrough
The exact commands, paths, and tool names used, copied from the actual system
Known failure modes and recovery steps, from your experience or the system's documentation
Confirm that all technical details (commands, hostnames, paths, error codes) come from your own environment and tools, not from the AI
Redact credentials, API keys, and any secrets before pasting. Follow your organization's data handling policy for system details marked sensitive or classified

VERIFY BEFORE IT LEAVES YOUR HANDS

Every command and file path in the runbook tested in the actual environment before the document is published
No hostnames, IP addresses, or system names appear that were not in your notes
Verification section describes a real, observable outcome you confirmed yourself
Failure Modes section contains only scenarios you supplied, not AI-invented error conditions
All [PLACEHOLDER] fields resolved with real values before the runbook goes into use
A second team member walks the runbook cold and can complete the task without asking questions
No credentials, keys, or sensitive configuration values are present in the published document

Sample output

Sample output. Generated by AI from sample inputs:

# Runbook: Rotate Application Service Account Password
System: Northwind Corp Active Directory / IIS Web Farm
Version: 1.0 | Owner: J. Mercer | Last reviewed: 2026-06-13

## Overview
This runbook covers the quarterly rotation of the svc_webapp service account password used by the Northwind e-commerce application on IIS. Incorrect rotation causes application authentication failures.

## Pre-conditions
- Maintenance window is active (Saturday 02:00-04:00 local)
- You have Domain Admin rights in CORP domain
- You have RDP access to WEB-APP-03 and WEB-APP-04
- Backup of IIS application pool credentials is current (verify with the config backup runbook)

## Tools and Access Required
- Active Directory Users and Computers (ADUC) or PowerShell with RSAT
- RDP client
- IIS Manager on WEB-APP-03 and WEB-APP-04
- Password manager access for svc_webapp entry

## Procedure

1. Generate a new password meeting the CORP complexity policy.
   1a. Use the approved password manager to generate a 20-character random password.
   1b. Save the new password to the svc_webapp entry before continuing.

2. Update the password in Active Directory.
   2a. Open ADUC or run: `Set-ADAccountPassword -Identity svc_webapp -Reset`
   2b. Enter the new password when prompted.
   2c. Confirm the command completes without error.

3. Update the IIS application pool on WEB-APP-03.
   3a. RDP to WEB-APP-03.
   3b. Open IIS Manager. Navigate to Application Pools.
   3c. Right-click NorthwindAppPool. Select Advanced Settings.
   3d. Under Process Model, update Identity password to the new value.
   3e. Click OK. Recycle the application pool.

4. Repeat step 3 on WEB-APP-04.

5. Restart the Northwind Windows Service on WEB-APP-03 and WEB-APP-04.
   5a. Run: `Restart-Service -Name NorthwindSvc`

## Verification
Navigate to https://[APP URL]/healthcheck from an internal workstation. The page must return HTTP 200 and display "Status: OK" within 60 seconds of the service restart. If it does not, go to Failure Modes.

## Failure Modes and Recovery
- Health check returns HTTP 500 or login error: the new password likely did not save to one IIS pool. Re-open IIS Manager on both servers, verify the password under Advanced Settings, and recycle both pools.
- AD password change fails with Access Denied: confirm your account is in the Domain Admins group and retry.

## Escalation
If the application does not recover within 15 minutes: contact [ESCALATION CONTACT] at [PHONE/SLACK] and open a P1 incident ticket.

## Revision History
| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | 2026-06-13 | [AUTHOR] | Initial draft |

CUSTOMIZATION

Add a rollback section for procedures that change system state and cannot be easily undone. For Linux environments, swap the IIS steps for systemd or service manager commands and adjust the path conventions. If your org uses a ticketing system, add a step to log the change before and after. Teams with a formal change management process should add a Change Request field to the header.

Download .md

Standard Operating Procedure

Writes a formal Standard Operating Procedure (SOP) document from your notes and policy inputs. Use it when a procedure needs to meet an audit, compliance, or HR standard and informal runbooks are not enough.

FREE WITH ACCOUNT

Knowledge Base Article

OPEN SAMPLE

Writes a structured knowledge base (KB) article from notes about a resolved issue or technical question. Use it right after closing a ticket so the fix is captured before context fades.

SYSTEM OR APPLICATION ·ISSUE SUMMARY ·SYMPTOMS ·ROOT CAUSE ·RESOLUTION STEPS ·VERIFICATION STEPS ·WORKAROUNDS ·TICKET OR REFERENCE NUMBER ·AUDIENCE

## Context
You are a technical writer helping an IT or cybersecurity professional capture a resolved issue or technical question as a reusable knowledge base (KB) article. The audience is a team member or end user who hits the same problem later and needs to solve it without escalating.

System or application: [SYSTEM OR APPLICATION]
Issue summary: [ISSUE SUMMARY]
Symptoms as the user experienced them: [SYMPTOMS]
Root cause: [ROOT CAUSE]
Resolution steps taken: [RESOLUTION STEPS]
Verification that the issue is resolved: [VERIFICATION STEPS]
Any workarounds if the full fix is not available: [WORKAROUNDS]
Related ticket number or reference: [TICKET OR REFERENCE NUMBER]
Audience (end user, tier-1 technician, or engineer): [AUDIENCE]

## Task
Produce a KB article with these sections: Title, Summary (two sentences), Applies To, Symptoms, Root Cause, Resolution, Verification, Workaround (if applicable), Related Resources.

## Standards
- Title format: [Action or Resolution] for [Issue] on [System]. Example: Fix for Login Failure After Password Reset on Okta.
- Write for the stated audience. End-user articles avoid command-line steps. Engineer articles can include commands verbatim.
- Include exact steps, commands, and paths only when the author supplied them. Mark any value you cannot fill as [PLACEHOLDER].
- Root Cause states only what the author supplied. Do not theorize beyond the supplied facts.
- Do not invent error codes, log lines, CVE identifiers, hostnames, or system behaviors not in the inputs.
- Related Resources lists only references the author provides. Write [ADD REFERENCES] if none were supplied.
- If symptoms or resolution steps are missing, ask before drafting.

BEFORE YOU RUN IT

The resolved ticket or incident record with the actual symptoms reported by the user
The root cause as documented during the investigation, not reconstructed from memory
The exact resolution steps taken, including commands or settings changed, from your notes or the ticket
Confirm that all technical details (error messages, commands, system names) come from your actual case and environment, not from the AI
Redact any customer personally identifiable information (PII), credentials, or sensitive configuration data before pasting, per your data handling policy

VERIFY BEFORE IT LEAVES YOUR HANDS

Resolution steps verified to work in the actual environment before the article is published
Symptoms match what the user actually reported, not an AI paraphrase that changes the meaning
Root cause confirmed by investigation, not inferred by the AI from the symptoms
No invented error codes, log entries, or system behaviors appear in the article
Audience level is appropriate: commands and technical terms that end users cannot act on are removed from user-facing versions
Article reviewed by a second technician who was not part of the original resolution

Sample output

Sample output. Generated by AI from sample inputs:

# Fix for VPN Client Disconnect After Windows Update on GlobalProtect

## Summary
Users on Windows 11 workstations running GlobalProtect 6.2 may experience automatic VPN disconnection after installing the June 2026 cumulative update (KB5039302). Reverting the network adapter driver resolves the issue.

## Applies To
- Operating system: Windows 11 22H2 and 23H2
- VPN client: Palo Alto GlobalProtect 6.2.x
- Affected systems: Domain-joined workstations at Northwind Corp

## Symptoms
- VPN connects but drops within 30-90 seconds
- Event Viewer shows: "Network connection lost" under Application logs
- Issue began after Windows Update on or after June 10, 2026

## Root Cause
The June 2026 cumulative update (KB5039302) replaced the Intel Ethernet adapter driver with a version incompatible with the GlobalProtect virtual adapter on affected hardware. The driver version introduced was 12.19.1.36.

## Resolution
1. Open Device Manager on the affected workstation.
2. Expand Network Adapters.
3. Right-click the Intel Ethernet adapter. Select Properties.
4. Go to the Driver tab. Click Roll Back Driver.
5. Select the rollback reason and confirm.
6. Restart the workstation.
7. Connect to GlobalProtect and confirm stability over 5 minutes.

## Verification
VPN connection holds for at least 5 minutes without dropping. Event Viewer shows no network disconnect events during that window.

## Workaround
If rollback is not available (hardware has no prior driver stored), pause Windows Update and contact the IT Help Desk. A driver package is available on the internal software share at [PATH].

## Related Resources
- Ticket: HD-20481
- Vendor advisory: [ADD REFERENCES]

CUSTOMIZATION

For end-user-facing articles in a self-service portal, strip the Event Viewer steps and replace the resolution with click-by-click instructions with screenshot placeholders. For engineering-level articles, add a section on detection signals (what monitoring alerted, what logs showed) so future responders know how to find it fast. Link the KB article to the incident record in your ticketing system so the connection is searchable.

Download .md

Network Diagram Description

Turns your notes about a network environment into a clear written description of the topology, segments, and traffic flows. Use it when you need to document a network for a handoff, audit, or architecture review and do not yet have a formal diagram.

FREE WITH ACCOUNT

Project README

Writes a project README for an IT tool, script, or internal project from your notes. Use it when you finish building something and need a document that lets someone else pick it up without asking you.

FREE WITH ACCOUNT

Configuration Documentation

Documents the configuration of a system, service, or device from your notes so the setup can be understood, audited, or reproduced. Use it after completing a build or change, while the details are still accurate.

FREE WITH ACCOUNT

Team Onboarding Doc

Creates a structured onboarding document for a new IT or security team member covering environment access, tools, key contacts, and first-week priorities. Use it before a new hire or contractor starts so they can move independently within days.

FREE WITH ACCOUNT

Troubleshooting Guide

Builds a structured troubleshooting decision guide for a system or service so technicians can work through problems in order without escalating prematurely. Use it for high-frequency support issues or after resolving a complex problem.

FREE WITH ACCOUNT

Asset Inventory Doc

Structures an asset inventory from your notes and exports into a documented, auditable format covering hardware, software, and key attributes. Use it to start or refresh an inventory that will feed vulnerability management, access reviews, or compliance audits.

FREE WITH ACCOUNT

DR and Backup Procedure Doc

Documents disaster recovery (DR) and backup procedures for a system or environment from your notes so the steps can be followed under pressure. Use it after setting up or testing backup and recovery processes, while the details are accurate.

FREE WITH ACCOUNT

Changelog and Release Notes

Writes a changelog or release notes document for an IT system, tool, or infrastructure change from your notes. Use it after completing a change or deployment so stakeholders and team members know what changed, why, and what to watch for.

FREE WITH ACCOUNT

System Architecture Doc

Turns your notes and diagrams into a structured architecture document that a new engineer or auditor can follow. Use it when you need a written record of how a system is built, what it connects to, and why key decisions were made.

FREE WITH ACCOUNT

All 140 prompts in this library are free with a VetsLearn account: every prompt, every checklist, synced to your account.

Unlock free with an account →

Internal API Usage Doc

Produces a clear usage document for an internal API so that developers on other teams can consume it without asking the owning team for help. Use it when a new internal API goes live or when an undocumented one needs a proper reference.

FREE WITH ACCOUNT

Project Handover Doc

Creates a structured handover document so a new team or engineer can take over a system or project without losing context. Use it before a rotation, a transition, or a contract end when institutional knowledge needs to transfer cleanly.

FREE WITH ACCOUNT

Technical Glossary

Builds a team glossary of technical terms, acronyms, and org-specific jargon so that new hires and cross-functional collaborators can get up to speed quickly. Use it when your team has accumulated shorthand that outsiders cannot follow.

FREE WITH ACCOUNT

Policy-to-Procedure Translation

Converts a policy statement into an actionable step-by-step procedure that staff can follow without interpretation. Use it when a policy exists but no one has written out what to actually do.

FREE WITH ACCOUNT

Architecture Decision Record

Writes a clear Architecture Decision Record (ADR) that captures why a technical decision was made, what alternatives were considered, and what the trade-offs are. Use it right after a design decision to lock in the reasoning before it fades.

FREE WITH ACCOUNT

Documentation Gap Audit

Analyzes a list of your existing docs against what your environment actually requires and produces a prioritized gap report. Use it during a documentation drive, before an audit, or when onboarding reveals that critical information only lives in someone's head.

FREE WITH ACCOUNT

End-User Guide

Writes a clear, step-by-step guide for non-technical end users explaining how to use an IT system or follow an IT process. Use it when a new tool is deployed or a policy changes and staff need instructions they can actually follow.

FREE WITH ACCOUNT

IT FAQ Builder

Builds a practical IT FAQ from your help desk ticket history, common user questions, or policy rollout questions. Use it when the same questions keep hitting the help desk and a published FAQ would free up analyst time.

FREE WITH ACCOUNT

Naming Convention Standard

Produces a clear naming convention standard for IT assets, files, or systems that the whole team can apply consistently. Use it when naming is inconsistent across the environment and it is causing confusion in tickets, audits, or automation.

FREE WITH ACCOUNT

Diagram Spec for Drawing Tools

Writes a text specification for a technical diagram that a drawing tool (Visio, draw.io, Lucidchart) can be built from. Use it when you know what a diagram should show but need a structured spec before opening the drawing tool.

FREE WITH ACCOUNT

All 140 prompts in this library are free with a VetsLearn account: every prompt, every checklist, synced to your account.

Unlock free with an account →

This library is defensive and operational by design. It does not produce exploit code, malware, or attack instructions, and it is not a substitute for your security team or counsel.
AI output is a first draft. Never trust a CVE, an indicator of compromise, a log line, or a control mapping it produces. Verify every one against your own tools and the authoritative source.
Redact secrets, credentials, customer data, and anything classified before pasting. You remain responsible for what leaves your hands.