Prompt lesson · 21 prompts
Incident Response and Management prompts for Systems Administrators
21 ready-to-use prompts from our AI for Systems Administrators course. Copy one, fill in the {{placeholders}}, and paste it into ChatGPT, Claude, Gemini or any other AI.
Incident Triage and Assessment
Use this when you need to assess and classify incidents during triage to determine severity and initial response steps.
Role You are an incident triage specialist who helps assess and classify incidents to guide initial response actions.
Context you provide
- {{incident_description}}: A detailed description of the incident, including affected system, nature of issue, and immediate impacts.
- {{severity_scale}}: The scale to use for classification (e.g., Low/Medium/High/Critical).
- {{additional_evidence}}: Any error messages, logs, or other details that help assess severity.
Instructions
- If the incident description is incomplete, ask for the missing details before proceeding.
- Assess the incident's severity level based on the provided scale and justify your choice with impact analysis.
- Identify any additional evidence or details that would help refine the assessment.
- Recommend initial response steps to minimize impact, tailored to the severity level.
- Outline any immediate communication or escalation needs based on severity.
Output format Provide a structured triage assessment with: severity level, justification, recommended initial actions, and any escalation notes. Keep it concise and actionable.
Guardrails
- Do not assume details not provided; ask for clarification if needed.
- Base severity assessment strictly on the given information and scale.
- Stay within triage scope; do not provide full incident resolution steps unless requested.
Example
- {{incident_description}}: "Database server is down, affecting all customer transactions." {{severity_scale}}: "Low/Medium/High/Critical" {{additional_evidence}}: "Error log shows connection timeout."
Open this prompt Analysis · Beginner
Document Incidents Thoroughly for Analysis
Use this when you need to capture comprehensive incident details for post-incident analysis, compliance, and future prevention.
Role You are a meticulous incident documentation specialist, skilled at structuring detailed and accurate records that support analysis, compliance, and future prevention.
Context you provide
- {{incident_description}}: What happened, including date, time, and systems affected (e.g., "server outage on May 5, 2025, 10:00 UTC").
- {{sequence_of_events}}: The chronological order of events leading up to the incident, including error messages or warnings.
- {{troubleshooting_actions}}: All actions taken to mitigate the issue, with outcomes and timestamps.
- {{impacted_systems}}: Specific systems or components affected, such as server names, IP addresses, and configurations.
Instructions
- Ask for any missing inputs before starting.
- Organize the provided information into a structured incident report with clear sections: Overview, Timeline, Troubleshooting Actions, Impacted Systems, and Recommendations.
- Ensure all details are precise, including timestamps and technical specifics.
- Identify any gaps in the documentation and suggest what additional information might be needed.
- Recommend a format for presenting the incident in a formal report, considering compliance requirements.
Output format Provide the incident report in a structured format with headings and bullet points. Use a neutral, factual tone. Include a section for "Recommendations" that suggests improvements for future incident handling.
Guardrails
- Do not invent any details; only use the information provided.
- Flag any missing information explicitly rather than guessing.
- Keep the report focused on the incident and avoid unrelated commentary.
Example Incident description: "server outage on May 5, 2025, 10:00 UTC", Sequence of events: "10:00 - server unresponsive, 10:05 - monitoring alert triggered", Troubleshooting actions: "10:10 - restarted service, 10:15 - restored from backup", Impacted systems: "web-server-01 (192.168.1.10), database-cluster".
Open this prompt Analysis · Intermediate
Manage Stakeholder Communication During Incidents
Use this when you need to plan and execute clear, transparent communication with stakeholders during an IT incident.
Open this prompt Planning · Intermediate
Perform Root Cause Analysis
Use this when you need to systematically identify the underlying cause of an incident to prevent recurrence.
Open this prompt Analysis · Advanced
Incident Escalation Summary
Use this when you need to prepare a clear, concise incident summary for escalation to management or other teams.
Open this prompt Writing · Intermediate
Incident Resolution Tracking
Use this when you need to monitor the progress of incident resolution and keep stakeholders informed.
Open this prompt Analysis · Intermediate
Enrich Incident Knowledge Base
Use this when you need to systematically capture and document incident insights to improve your knowledge base.
Open this prompt Creating · Intermediate
Conduct Post-Incident Review
Use this when you need to systematically analyze an incident after resolution to identify improvements and prevent recurrence.
Open this prompt Analysis · Intermediate
Incident Trend Analysis
Use this when you need to analyze incident data to identify patterns, recurring issues, and proactive measures.
Open this prompt Analysis · Intermediate
Incident Response Training Program
Use this when you need to design or improve a training program for incident response teams.
Open this prompt Creating · Intermediate
Incident Triage Information Gathering
Use this when you need to systematically gather initial incident details to support effective triage.
Open this prompt Communication · Beginner
Incident Knowledge Base Setup
Use this when you need to create or improve a centralized knowledge base for incident response procedures.
Open this prompt Planning · Intermediate
Automated Escalation Workflow
Use this when you want to design or refine an automated system that escalates incidents based on severity and urgency.
Open this prompt Planning · Advanced
Coordinate Incident Communications Effectively
Use this when you need to draft and manage stakeholder messages during a critical incident, ensuring timely and accurate updates.
Open this prompt Communication · Intermediate
Incident Report Generation
Use this when you need to compile a detailed incident report from raw data and ensure it is clear and consistent.
Open this prompt Writing · Beginner
Incident Response Simulation
Use this when you need to practice incident response through realistic simulations for training or preparedness.
Open this prompt Creating · Advanced
Incident Trend Analyzer
Use this when you need to analyze incident data to identify patterns and derive actionable insights for proactive management.
Open this prompt Analysis · Intermediate
Incident Response Workflow Optimization
Use this when you need to analyze and improve your incident response workflow for efficiency and effectiveness.
Open this prompt Analysis · Advanced
Incident Severity Classification
Use this when you need to classify incident severity levels to prioritize response efforts.
Open this prompt Analysis · Beginner
Incident Response Metrics Analysis
Use this when you need to track, visualize, and improve key incident response metrics like mean time to detect and resolve.
Open this prompt Analysis · Intermediate
Incident Response Guidance
Use this when you need step-by-step guidance for responding to IT incidents like network outages, security breaches, server crashes, or application failures.
Open this prompt Planning · Intermediate