Security operations center (SOC) analysts are expected to process a constant stream of alerts — often under tight response timelines.
At the same time, they are expected to investigate accurately, document clearly, and communicate findings to both technical and non-technical stakeholders. This is where generative artificial intelligence (GenAI) tools such as ChatGPT can be helpful.
The table below provides a quick reference to 10 ChatGPT prompts that can help L1 SOC analysts.
While these prompts are useful for L1 analysts, they can also support L2/L3 analysts and anyone looking to better understand common incident response (IR) tasks.
Be careful not to enter sensitive data into public AI tools, and consider turning these prompts into an AI agent to help automate parts of the workflow.
| Prompt # | Prompt Use Case | What It Helps With | Why It Matters in a SOC |
| 1 | Summarize a security alert | Summarizes alert data and converts alert data for non-technical audiences. | Helps L1 analysts triage and understand alert significance. |
| 2 | Analyze raw logs | Identifies suspicious activity, indicators, and patterns in logs. | Helps with investigation of log data. |
| 3 | Create a triage checklist | Builds a step-by-step investigation workflow, if a playbook is not already available. | Helps L1 analysts respond to unfamiliar alerts. |
| 4 | Draft case notes | Turns rough notes into clean ticket documentation. | Helps improve note quality, handoffs, and auditability. |
| 5 | Write an escalation summary | Creates a concise escalation to L2/3 analysts. | Helps reduce back-and-forth on ticket data. |
| 6 | Analyze phishing emails | Reviews suspicious emails for red flags. | Helps analysts assess phishing email threats. |
| 7 | Map to MITRE ATT&CK | Aligns observed behavior to TTPs. | Helpful for L1 analysts to improve threat context and reporting. |
| 8 | Generate threat hunting ideas | Suggests hypotheses and follow-up hunt paths. | Helpful for L1/L2 analysts that are newer to threat hunting. |
| 9 | Improve SIEM detections | Suggests detection logic, tuning ideas, and false positive considerations. | Helps support detection coverage. |
| 10 | Write an executive summary | Translates technical findings into business language. | Helps communicate incident data clearly to leadership and stakeholders. |
When used appropriately, genAI tools like ChatGPT can help SOC analysts accelerate repetitive tasks such as summarizing alerts, identifying suspicious patterns in logs, drafting ticket notes, and translating technical findings into business language.
However, genAI and AI agents should not fully replace human judgment. Instead, they should serve as a force multiplier that helps analysts organize information better and reduce time spent on repetitive writing and interpretation tasks.
The prompts below are designed to help SOC analysts use ChatGPT as part of their daily operations workflow.
1. Summarize a security alert
Security tools often generate verbose detections filled with vendor-specific language, process details, metadata, or behavior descriptions that can slow down triage — especially for junior analysts.
Prompt:
Summarize the following security alert data in simple terms for a L1 SOC analyst. Include what happened, why it matters, likely severity, and the first three investigation steps I should take: [paste alert/log/EDR detection].
This type of prompt helps transform raw alert data into a more readable explanation.
Rather than forcing the L1 analyst to decode every field or technical phrase manually, ChatGPT can produce a concise summary that explains what the alert is indicating and why it may be important.
2. Analyze raw logs for suspicious activity
Reviewing these log data manually can be time-consuming, especially when analysts are trying to identify whether a pattern is benign or potentially malicious.
Prompt:
Analyze the following logs and identify suspicious activity, notable indicators, possible attacker behavior, and recommended next steps for investigation: [paste/attach log data].
This prompt can help L1 analysts identify unusual authentication attempts, repeated failures, odd process launches, suspicious domains, unusual geographic access, or signs of command-and-control (C2) activity.
While the analyst still needs to validate the output, ChatGPT or AI agents can help reduce initial review time and point the analyst in the right direction.
3. Create a triage checklist for an alert
ChatGPT can help L1 analysts approach unfamiliar alerts with a more consistent, repeatable investigation process in the absence of existing incident response playbooks.
Prompt:
Act like an experienced L1 SOC analyst. Based on this alert, create a step-by-step triage checklist I should follow, including what to validate, what evidence to collect, and when to escalate: [paste/attach alert details].
This prompt is helpful for L1 analysts for alerts like suspicious PowerShell activity, impossible travel alerts, phishing, or unusual outbound traffic because it helps give the analysts a structured starting point for investigation.
4. Draft professional case notes or ticket updates
Documentation is a core part of SOC work. Analysts are expected to write clear ticket notes that explain what was investigated, what evidence was reviewed, what actions were taken, and what the current status is.
Poor documentation can make handoffs difficult and create confusion later during escalation or deeper incident review.
Prompt:
Write a professional SOC case note based on the following investigation details. Keep it concise, clear, and suitable for an incident ticket. Include findings, actions taken, and current status: [paste/attach notes].
This prompt helps analysts turn rough notes into cleaner, more professional case documentation. It can improve consistency in case handling and save time, especially when analysts are juggling multiple tickets at once.
5. Draft an escalation message to Tier 2 or incident response
Not every alert can be resolved at the initial triage stage. When an L1 analyst identifies something — such as possible credential compromise, malware execution, suspicious administrative behavior, or ransomware activity — they often need to escalate quickly and clearly.
Prompt:
Draft a concise escalation message for a L2/L3 analyst based on the following alert and findings. Include what was observed, why it is concerning, what has already been validated, and recommended next actions: [paste/attach findings].
This helps L1 analysts communicate the information without burying the important details in extra words. Good communication for ticket escalation should reduce back-and-forth and make it easier for the next team members to pick up the investigation efficiently.
6. Analyze suspected phishing emails
Phishing is a common issue that requires analysts to assess email content, sender details, headers, links, and social engineering cues to determine whether a message is malicious or simply spam.
Prompt:
Analyze this suspected phishing email and identify red flags, likely attacker tactics, suspicious indicators, and recommended response actions. Include whether this appears to be credential harvesting, malware delivery, business email compromise, or simply spam: [paste/attach email headers/body/URLs].
This prompt can help L1 analysts identify spoofing indicators, suspicious domains, urgency language, impersonation tactics, attachment risks, and possible malicious links. It can also help junior analysts better understand how phishing attacks are structured.
7. Map activity to the MITRE ATT&CK framework
The MITRE ATT&CK framework is used to help classify threat actor tactics, techniques, and procedures (TTPs). L1 analysts often need to understand where suspicious activity fits within the broader attack lifecycle.
Prompt:
Map the following observed activity to likely MITRE ATT&CK tactics and techniques. Explain why each mapping fits and what additional evidence would help confirm it: [paste findings or event summary].
This helps L1 analysts think more strategically about attacker behavior rather than viewing an alert in isolation. It can also improve reporting quality, threat hunting, and communication with other teams.
8. Generate threat hunting ideas
SOC analysts are not limited to reactive alert handling. In more mature environments, analysts are often expected to hunt proactively for signs of compromise based on indicators of compromise (IOCs).
While threat hunting is traditionally done by more senior level analysts, the use of AI agents in SOCs is freeing L1 analysts to upskill for threat hunting and deeper threat intelligence activities.
Prompt:
Based on this alert or suspicious behavior, suggest 10 threat hunting hypotheses and what data sources or queries I should use to investigate further: [paste/attach alert, IOC, or behavior].
This type of prompt can help L1 analysts expand an isolated detection into broader hunting activity across the environment.
For example, if a suspicious PowerShell command appears on one host, AI can help suggest ways to look for similar execution elsewhere in endpoint, authentication, proxy, or DNS logs.
9. Improve or create SIEM detection ideas
Although not every L1 SOC analyst is formally part of a detection engineering team, some analysts identify control gaps as they investigate incidents.
AI tools, like ChatGPT, can help analysts think through how suspicious behaviors could be translated into better detection logic.
Prompt:
Help me create or improve a SIEM detection for the following suspicious behavior. Include detection logic ideas, key fields to monitor, false positive considerations, and tuning recommendations: [describe activity].
This can be useful for building ideas around detections for brute force activity, suspicious PowerShell usage, privilege escalation, unusual service creation, lateral movement, or abnormal authentication patterns.
It also helps L1 analysts think more like defenders who improve visibility and tune detections, not just respond to alerts.
10. Write an executive-friendly incident summary
One of the more overlooked SOC skills is communication.
Analysts are often asked to explain incidents to stakeholders who are not deeply technical, such as managers, compliance teams, legal teams, or executives. Technical jargon that makes sense to analysts may be confusing or unhelpful to business stakeholders.
Prompt:
Write a non-technical incident summary for a manager or executive audience based on the following investigation details. Explain what happened, business impact, current status, and recommended next steps without using heavy technical jargon: [paste/attach incident details].
This prompt helps analysts practice translating technical findings into business language. That is an important skill because incidents are not just technical events — they often have operational, financial, reputational, and compliance implications as well.
Important reminder: Do not paste sensitive data into public AI tools
While tools like ChatGPT can be useful for SOC workflows, they must be used responsibly.
SOC analysts should never paste sensitive, confidential, regulated, or internal/proprietary security data into a public AI tool unless their organization has explicitly approved that usage.
Examples of data that should not be pasted into unapproved public AI systems include:
- Customer or employee personal data
- Credentials or secrets
- Internal IP addresses or asset inventories
- Proprietary logs
- Sensitive incident details
- Regulated or classified information
- Internal investigation notes containing identifiable system or user data
A safer approach is to sanitize or redact information before using AI.
That may include removing usernames, hostnames, domains, email addresses, IP addresses, file hashes tied to internal systems, or any information that could expose the organization or its users.
Ideally, SOC teams should use only approved enterprise AI tools that align with the organization’s legal, privacy, and security requirements.
Bottom line
ChatGPT and other AI tools can be practical productivity aids for SOC analysts when used appropriately.
They help analysts summarize, structure, document, interpret, and communicate security information more efficiently, reducing repetitive work, improving consistency, and allowing more focus on detection engineering, threat hunting, and threat intel.
However, the value of AI in the SOC depends on how it is used. Analysts still need to validate findings, apply critical thinking, and follow internal procedures/playbooks.
AI can speed up the work, but it should never fully replace humans.
For L1 SOC analysts looking to improve efficiency, these prompts offer a practical starting point for integrating AI into daily workflows.
