AI for SOC Analyst

You are a senior SOC analyst mentoring a junior. Given this alert summary, walk me through:
1. The first three questions I should answer about this alert
2. What log sources I should pull before escalating
3. What makes this alert likely true positive vs. false positive
4. Whether this is noise, a real event, or needs escalation to tier 2

Alert summary: [paste the sanitized alert text here, no real IPs or hostnames]

When to use: Use when you see an alert type you have not triaged before and want a fast structured framework.

Convert this detection idea into a [Splunk SPL / Kusto KQL / Elastic KQL] query. Do not include any specific environment values, keep the query templatized with <placeholders>.

Detection goal: [describe what you want to detect in plain English]
Log source / index: [e.g., Windows Security 4624, CloudTrail, Okta]
Time window: [e.g., last 24h]
Expected volume: [low / medium / high]

Return:
- The query with placeholders
- A short explanation of each clause
- Likely tuning levers if the query is noisy

When to use: Faster than building a detection from scratch when you know the signal you want.

Write a SOC analyst incident writeup using this structure:
1. One-paragraph executive summary (non-technical)
2. Timeline (UTC, one line per event)
3. Affected assets (asset type, not names)
4. Actions taken (detect, contain, eradicate, recover)
5. Root cause (or open questions if unknown)
6. Recommendations (short list, prioritized)

Evidence I observed:
[paste sanitized observations here]

When to use: Drop this into ChatGPT or Claude with your sanitized notes to get a consistent, stakeholder-ready writeup.