Prompt lesson · 21 prompts
Incident Response Planning prompts for Cybersecurity Analysts
21 ready-to-use prompts from our AI for Cybersecurity Analysts course. Copy one, fill in the {{placeholders}}, and paste it into ChatGPT, Claude, Gemini or any other AI.
Classify and Prioritize Security Incidents
Use this when you need to develop a framework for classifying and prioritizing cybersecurity incidents to allocate resources effectively.
Role You are a cybersecurity incident management expert who helps organizations classify and prioritize incidents to optimize response efforts.
Context you provide
- {{incident_type}}: The type of incident (e.g., malware, phishing, DDoS, insider threat).
- {{metrics}}: The key metrics to consider for classification (e.g., data compromise, operational impact, financial loss).
- {{industry}}: The industry context (e.g., finance, healthcare, government).
- {{factors}}: Additional factors for prioritization (e.g., threat sophistication, regulatory impact).
Instructions
- Ask for any missing inputs before starting.
- Develop a classification framework that categorizes incidents by severity levels (e.g., low, medium, high, critical).
- Define prioritization criteria based on the provided metrics and factors.
- Provide a decision-making model that guides resource allocation.
- Include a risk assessment and impact analysis method tailored to the industry.
Output format A structured framework with clear categories, criteria, and a decision matrix. Use tables or bullet points for clarity.
Guardrails
- Do not invent specific metrics; use the ones provided or ask for clarification.
- Ensure the framework is adaptable to different incident types.
- Avoid making assumptions about the organization's existing processes.
Example incident_type: ransomware, metrics: data compromise, operational impact, industry: healthcare, factors: threat sophistication, financial impact.
Open this prompt Planning · Advanced
Classify Security Incidents by Severity
Use this when you need to systematically categorize cybersecurity incidents by severity and business impact to guide response priorities.
Role You are a cybersecurity incident response expert. Your goal is to help me classify incidents accurately by severity and business impact so we can prioritize responses effectively.
Context you provide
- {{incident_type}}: e.g., data breach, malware infection, ransomware, DDoS.
- {{industry}}: e.g., healthcare, finance, retail, government.
- {{organization_scale}}: e.g., small business, large enterprise, non-profit.
- {{incident_details}}: any specifics like affected systems, data sensitivity, or observed impact.
Instructions
- If any required context is missing, ask for it before proceeding.
- Define a severity classification framework (e.g., critical, high, medium, low) based on common standards like NIST or SANS.
- Map the provided incident type and details to the framework, explaining the reasoning for each classification factor (e.g., data exposure, system criticality, regulatory impact).
- Tailor the classification to the specified industry and organization scale, noting any special considerations (e.g., HIPAA for healthcare, PCI for finance).
- Provide practical recommendations for prioritizing response actions based on the classification.
Output format A structured response with: a brief summary of the classification, a table of severity levels with criteria, the specific classification for the given incident, and prioritized action steps. Use clear, professional language.
Guardrails
- Do not invent facts about the incident; base analysis only on provided details.
- Flag any assumptions about the incident or organization.
- Stay within the scope of incident classification; do not provide legal advice or detailed remediation steps unless asked.
Example
- {{incident_type}}: ransomware attack; {{industry}}: healthcare; {{organization_scale}}: mid-sized hospital; {{incident_details}}: patient records encrypted, backup partially compromised.
Open this prompt Analysis · Intermediate
Communicate Incident Status to Stakeholders
Use this when you need to craft clear, timely updates for stakeholders during a cybersecurity incident.
Open this prompt Communication · Beginner
Conduct Incident Post-Mortem
Use this when you need to analyze a past security incident to identify lessons learned and improve future response efforts.
Open this prompt Analysis · Intermediate
Contain Security Incidents Effectively
Use this when you need step-by-step guidance to isolate and contain a cybersecurity incident to prevent further damage.
Open this prompt Planning · Intermediate
Coordinate Incident Response Across Teams
Use this when you need to plan and improve coordination among internal teams, external partners, and agencies during an incident.
Open this prompt Planning · Intermediate
Design Incident Escalation Procedures
Use this when you need to create or refine escalation procedures for cybersecurity incidents, including severity criteria and communication paths.
Open this prompt Planning · Intermediate
Document Security Incidents Thoroughly
Use this when you need to create detailed, accurate documentation of a cybersecurity incident for analysis, compliance, and learning.
Open this prompt Writing · Intermediate
Evidence Collection Best Practices
Use this when you need guidance on identifying, collecting, and preserving evidence during a cybersecurity incident for legal or forensic purposes.
Open this prompt Research · Intermediate
Incident Communication Templates
Use this when you need to draft clear and effective communication templates for notifying stakeholders about security incidents.
Open this prompt Creating · Intermediate
Incident Escalation Decision Guide
Use this when you need to assess a security incident's severity and decide whether and how to escalate it to stakeholders.
Open this prompt Decisions · Intermediate
Incident Recovery Planning
Use this when you need to develop a structured recovery plan after a cybersecurity incident to restore systems and mitigate vulnerabilities.
Open this prompt Planning · Intermediate
Incident Reporting
Use this when you need to compile a comprehensive incident report, including impact analysis and prevention recommendations.
Open this prompt Writing · Intermediate
Incident Reporting and Documentation
Use this when you need to create comprehensive incident reports that document actions taken, support compliance, and capture lessons learned.
Open this prompt Writing · Intermediate
Incident Response Metrics and Reporting
Use this when you need to generate performance metrics and reports to evaluate and improve your incident response program.
Open this prompt Analysis · Intermediate
Incident Response Plan Development
Use this when you need to create a tailored incident response plan that addresses specific threats and aligns with your organization's context.
Open this prompt Planning · Advanced
Incident Response Plan Review and Update
Use this when you need to review and update your incident response plan to address evolving threats and close gaps.
Open this prompt Analysis · Advanced
Incident Response Team Coordination
Use this when you need to structure and coordinate an incident response team during a security event.
Open this prompt Planning · Intermediate
Incident Simulation and Training
Use this when you need to create realistic incident scenarios to train your team and improve response skills.
Open this prompt Creating · Intermediate
Plan Incident Recovery Steps
Use this when you need to plan or improve the recovery process after a cybersecurity incident, ensuring business continuity and data integrity.
Open this prompt Planning · Intermediate
Security Incident Root Cause Analysis
Use this when you need to conduct a thorough investigation of a security incident to determine its root cause and recommend mitigations.
Open this prompt Analysis · Advanced