Module 9 of 10 — SOC Analyst Path
Module 09 — Intermediate

Using AI in Your Daily Workflow

⏱ 16 min read · 1 quiz question

Knowing that AI tools exist is one thing. Actually using them to move faster and work smarter is another. This module is practical — real prompts, real workflows, and real techniques you can start using today, whether you're in your first SOC job or still building toward it.

The analysts who are pulling ahead right now aren't necessarily the ones with the most experience. They're the ones who've figured out how to use AI as a force multiplier on every repetitive or research-heavy task in their day.

Prompt engineering basics for security analysts

A prompt is just the instruction you give an AI. But the quality of what you get back depends almost entirely on how well you frame the question. This is called prompt engineering — and you don't need to be a developer to get good at it.

Three principles that make a huge difference:

1. Give context, not just questions. Instead of asking "What does this log mean?" tell the AI what you know: "I'm a SOC analyst investigating a potential lateral movement alert. Here is a Windows Event Log entry — explain what happened and whether it's suspicious." Context shapes the answer.

2. Tell it what format you want. "Explain this in plain English" gets a different response than "Give me a bullet-point summary, followed by a severity assessment of Low/Medium/High/Critical with your reasoning." Be specific about the output format.

3. Ask it to think step by step. For complex analysis tasks, add "Think through this step by step" to your prompt. This helps AI models reason through multi-step problems rather than jumping to a conclusion.

Real prompts you can use today

These are production-ready prompts for common SOC tasks. Copy, adapt, and make them your own.

Alert Triage
I'm a SOC analyst triaging this alert. Tell me: (1) what likely triggered this, (2) whether it's probably a false positive or true positive and why, (3) what I should investigate next to confirm, and (4) what the severity level should be. Here is the alert: [paste alert]
Script / Malware Analysis
Analyze the following [PowerShell/Python/JavaScript] script. Deobfuscate it if needed, then explain line by line what it does, whether it appears malicious, and what indicators of compromise I should add to our blocklist. [paste script]
Detection Rule Writing
Write a Splunk SPL detection rule for the following behavior: [describe the attack pattern]. The rule should minimize false positives. Include a comment explaining the logic and note any edge cases I should test for.
Incident Report Draft
Turn these raw investigation notes into a structured incident report. Format it with sections for: Executive Summary, Timeline of Events, Affected Systems, Attack Vector, Actions Taken, and Recommendations. Keep the tone factual and professional. Notes: [paste notes]
CVE Research
Explain CVE-[number] in plain English. Cover: what it is, what systems are affected, how attackers are exploiting it in the wild, what the patch status is, and what detections I should put in place if we can't patch immediately.

AI-assisted alert triage workflow

Here's a practical AI-augmented triage workflow you can apply to almost any alert in your queue:

1
Read the alert (30 seconds)
Understand what fired, what asset is involved, and what the baseline behavior should be for that asset.
2
Feed context to AI (1–2 minutes)
Paste the alert details (sanitized) with the triage prompt above. Let AI give you a starting hypothesis and investigation path.
3
Verify in the SIEM (3–5 minutes)
Use the AI's suggested investigation path to pull correlated logs. Confirm or rule out the hypothesis with actual data.
4
Document with AI (2 minutes)
Feed your findings back to AI with the incident report prompt. Review, correct anything wrong, and submit. What used to take 20 minutes now takes 5.
The 10x rule: A good analyst with AI tools can work through roughly 3–5x as many alerts per shift as one without. That's not an exaggeration — it's what early adopters are reporting. The time savings compound across every repetitive task.

Using AI for threat hunting

Threat hunting is proactive — instead of waiting for an alert, you go looking for signs of attackers who may already be in the network. AI can accelerate this significantly.

Hypothesis generation: Ask the AI "Based on the MITRE ATT&CK framework, what are the most common techniques used in [specific attack type, e.g. ransomware pre-deployment]? For each, what logs or behavioral indicators should I look for?" This gives you a structured hunting plan in minutes instead of hours of research.

Pattern recognition across large datasets: AI-powered analytics in SIEMs like Chronicle and Sentinel can identify low-and-slow attack patterns that no single alert would catch — things like a user accessing slightly more files than usual each day for two weeks, or outbound connections to a C2 domain that only communicates at 3am.

What to watch out for: AI hallucinations

AI models can be confidently wrong. This is called a hallucination — the model generates an answer that sounds plausible but is factually incorrect. In a security context, this can mean:

  • A CVE description that's inaccurate or refers to the wrong software version
  • A detection rule that has a logical error and will never fire
  • A threat explanation that mixes up two different malware families

The rule: AI is a starting point, not a final answer. Always verify critical information against authoritative sources (NVD, vendor advisories, threat intel platforms) before acting on it. Use AI to get you 80% of the way there fast — then apply your own judgment to the last 20%.

Key Terms
Prompt engineering
The practice of crafting AI inputs (prompts) to get better, more accurate, or more useful outputs. A skill that makes analysts significantly more effective with AI tools.
Hallucination
When an AI model generates information that sounds correct but is factually wrong. A known limitation of LLMs that requires analyst verification of AI outputs.
Threat hunting
Proactive searching through a network for signs of hidden attackers, rather than waiting for automated alerts to fire.
MITRE ATT&CK
A globally recognized knowledge base of adversary tactics and techniques. Used as a framework for threat hunting hypotheses and detection engineering.
IOC (Indicator of Compromise)
Artifacts that suggest a system has been breached — IP addresses, file hashes, domain names. AI can extract these from malware analysis automatically.
✦ Quick Check
You paste an alert into an AI assistant and it tells you the alert is a false positive. What should you do?
Close the alert immediately — AI tools are very accurate
Escalate anyway since you can't trust AI
Ask the AI a second time to confirm
Use the AI's reasoning as a starting point, then verify in the SIEM before closing
← Previous
Next: The Future SOC Analyst →