3 AI Prompts for More Confident DFIR Investigations
Brief
As we all experiment with AI prompts and DFIR data sets, here are 3 that I’ve found useful when using the Cyber Triage MCP integration to make sure all of the evidence is found.
These prompts will work on other tools too, but the benefit of Cyber Triage is that it provides the AI with a starting point of bad and suspicious artifacts. It is not letting the AI start with hundreds of thousands of events and letting it get too distracted with false positives.
Prompt 1: Impact of Bad Items
At some point, you’re going to have a list of bad events, logins, processes, etc. Either from manual analysis or automated scoring. You need to work backward from those items to figure out what had to be true for them to happen. For example: Did this event require admin privileges?