Prompt lesson · 17 prompts
Threat Intelligence Gathering prompts for Information Security Analysts
17 ready-to-use prompts from our AI for Information Security Analysts course. Copy one, fill in the {{placeholders}}, and paste it into ChatGPT, Claude, Gemini or any other AI.
Adversary Emulation Planning
Use this when you need to simulate a threat actor's tactics to test your organization's defenses.
Role You are a senior security analyst specializing in adversary emulation. Your goal is to design realistic, safe, and controlled simulations that reveal defense gaps without causing harm.
Context you provide
- {{target_assets}}: The specific systems, data, or processes to test (e.g., email, network, backups).
- {{threat_profile}}: The type of adversary to emulate (e.g., social engineer, ransomware actor, nation-state).
- {{scope_limits}}: Any constraints or boundaries for the simulation (e.g., no production downtime).
Instructions
- Ask for any missing context before starting.
- Based on the threat profile, outline a step-by-step emulation plan, including initial access, persistence, and impact techniques.
- For each step, specify the tools or methods (e.g., phishing simulation, network scanning) and the expected detection points.
- Provide a risk assessment for each action, noting potential side effects and mitigation.
- Conclude with a prioritized list of defense improvements based on likely findings.
Output format A structured plan with sections: Objective, Threat Profile, Emulation Steps, Detection Points, Risk & Mitigation, and Recommended Defenses. Use tables where helpful. Keep tone professional and concise.
Guardrails
- Do not provide actual exploit code or instructions for real attacks.
- Flag any assumptions about the environment or threat actor.
- Stay within the provided scope; do not suggest actions outside the defined limits.
Example Target: email gateway; Threat: social engineering via spear-phishing; Scope: test only with internal test accounts.
Open this prompt Planning · Advanced
Analyze Malware Trends and Threats
Use this when you need to track, summarize, and analyze malware trends and emerging threats from various sources.
Role You are a cybersecurity threat intelligence analyst. Your goal is to provide clear, actionable insights on malware trends and emerging threats to help organizations strengthen their defenses.
Context you provide
- {{sources}}: Specific sources to analyze (e.g., security blogs, industry reports, research papers).
- {{threats}}: Specific threats of interest (e.g., ransomware, zero-day exploits, trojans).
- {{targets}}: Specific targets or industries affected (e.g., healthcare, finance, corporate networks).
- {{regions}}: Optional geographic regions to focus on.
Instructions
- If any required context is missing, ask for it before proceeding.
- Gather and synthesize information from the provided sources, focusing on the specified threats and targets.
- Identify and summarize recent malware trends, attack patterns, and emerging threats.
- Compare current trends with historical data if available, noting significant changes.
- Highlight sectors or regions that are particularly vulnerable.
- Provide actionable defensive measures and proactive mitigation strategies based on the analysis.
Output format Provide a structured report with sections: Executive Summary, Key Trends, Emerging Threats, Vulnerable Sectors, and Recommended Actions. Use bullet points for clarity and keep the tone professional and concise.
Guardrails
- Do not invent data; base analysis solely on provided sources.
- Flag any assumptions or gaps in data.
- Stay within the scope of malware trend analysis; do not provide general security advice.
Example Sources: 'security blogs', 'industry reports'; Threats: 'ransomware'; Targets: 'healthcare'.
Open this prompt Analysis · Intermediate
Assess and Prioritize Risks
Use this when you need to assess and prioritize security risks based on their potential impact and likelihood.
Open this prompt Analysis · Intermediate
Dark Web Monitoring Strategy
Use this when you need to monitor dark web sources for mentions of your organization or leaked data.
Open this prompt Planning · Advanced
Develop Incident Response Playbook
Use this when you need to create or update an incident response playbook based on threat intelligence and historical data.
Open this prompt Creating · Intermediate
Develop Security Awareness Training
Use this when you need to create or update security awareness training for employees based on current threats.
Open this prompt Creating · Intermediate
Facilitate Threat Intelligence Sharing
Use this when you need to aggregate, summarize, and share threat intelligence with partner organizations.
Open this prompt Communication · Intermediate
Gather Open-Source Intelligence
Use this when you need to collect and analyze publicly available information to identify potential threats, risks, or strategic insights.
Open this prompt Research · Intermediate
Integrate Threat Intelligence with Security Tools
Use this when you need guidance on integrating threat intelligence with SIEM, IDS/IPS, and endpoint protection.
Open this prompt Planning · Intermediate
Monitor Dark Web Threats
Use this when you need to monitor dark web forums and marketplaces for mentions of specific threats or illegal activities relevant to your organization.
Open this prompt Analysis · Advanced
Monitor Social Media Threats
Use this when you need to monitor social media platforms for mentions of security threats, vulnerabilities, or threat actors relevant to your organization.
Open this prompt Analysis · Intermediate
Phishing Email Pattern Analysis
Use this when you need to dissect phishing emails to uncover attacker tactics and potential sources.
Open this prompt Analysis · Intermediate
Prioritize Vulnerability Remediation
Use this when you need to analyze vulnerability scan results and prioritize patching efforts based on threat intelligence.
Open this prompt Analysis · Intermediate
Proactive Threat Hunting in Networks
Use this when you need to proactively search for signs of threats within your network using logs and security data.
Open this prompt Analysis · Advanced
Profile Threat Actors from Intelligence
Use this when you need to create detailed profiles of potential threat actors based on intelligence data.
Open this prompt Analysis · Advanced
Threat Intelligence Monitoring Setup
Use this when you need to establish automated monitoring of threat sources to detect potential business threats.
Open this prompt Automation · Intermediate
Vulnerability Analysis and Prioritization
Use this when you need to analyze vulnerability reports and system logs to identify and prioritize weaknesses.
Open this prompt Analysis · Intermediate