Workflows and use cases

These examples combine CloudSEK account data with GTI threat intelligence. You can use the prompts as written after replacing sample IDs, users, and dates.

For changes, use this sequence:

1. Inspect the records and show their current values.
2. Confirm the count and identifiers.
3. Ask for approval before the write.
4. Make the change.
5. Verify the operation ID in the audit trail, or poll the bulk job and report every failed or skipped record.

Morning triage

What it does: Summarizes the priority queue, unassigned work, active threat actors, trending CVEs, and suspicious indicators.

Give me a morning triage brief for the last 24 hours. Include the top five
threat actors, any trending CVEs, and my unassigned P0 incidents. End with the
three actions that need attention first.

Incident investigation

What it does: Combines the incident snapshot, audit history, alert details, IOC enrichment, and actor research.

Investigate incident XVA-123. Show its current state, audit trail, related
alerts, and any IOCs. Enrich the IOCs and identify threat actors that may be
related. Separate confirmed facts from possible associations.

CVE investigation

What it does: Checks GTI activity, affected products, exploitation context, and matching CloudSEK scanner alerts.

Investigate CVE-2024-12345. Show severity, affected products, patch status, GTI
mentions, known actor exploitation, and matching CloudSEK scanner alerts.

IOC enrichment

What it does: Checks an indicator in GTI, then looks for related CloudSEK alerts and incidents.

Enrich this IOC: 192.0.2.10. Check GTI feeds, find related CloudSEK alerts and
open incidents, and list associated threat actors with confidence and source.

Executive threat brief

What it does: Combines module activity, incident operations, GTI actors, and trending CVEs for a short management report.

Create an executive threat brief for the last seven days. Include the threat
landscape by module, incident SLA status, top threat actors, and trending CVEs.
State the three decisions or actions leadership should consider.

Threat hunting

What it does: Starts with active actors, finds related feeds and IOCs, then checks your CloudSEK alerts and open incidents for matches.

Hunt for activity related to the three most active threat actors. Find their
recent IOCs, check whether our CloudSEK alerts contain those indicators, and
show related open incidents. Do not treat an alias match as confirmed actor
attribution.

Incident closure with audit verification

Tools involved: get_snapshot, get_changelog, get_alerts, update_incident

Review incident XVA-1234, including its current state, audit history, and alert
evidence. If the evidence supports closure, show me the proposed status and
comment first. After I approve, close it as ClosedFalsePositive, add Jira ticket
IR-218 with URL https://jira.example.com/browse/IR-218 as the external
reference, and verify the change in the audit trail.

Event evidence review and remediation

Tools involved: get_snapshot, get_attachments, update_event, get_changelog

Review this event's current status, owner, and attachments. If the evidence
confirms the exposure is fixed, propose a ClosedResolved update with the
comment "Exposed asset removed under CHG-931." Wait for my approval, remediate
the event, and verify the audit entry.

Bulk queue cleanup

Tools involved: get_snapshot, bulk_update_incidents, get_job_status

Find open P1 credential breach incidents and show their IDs, owners, and total
count. Do not change anything yet. After I approve the list, assign them to
[email protected] with the comment "Moved to the credential breach response
queue." Poll the job to completion and report failed or skipped records.

One bulk job changes one field. If you need to change both priority and assignee, request two jobs and verify each one.

Analyst offboarding

Tools involved: get_snapshot, bulk_update_incidents, get_job_status

List all open and in-progress incidents assigned to [email protected].
Show the records before changing them. After I approve, reassign them to
[email protected] with the comment "Reassigned during offboarding handover
HR-3021." Poll the job and confirm that no record failed.

Shift handoff without updates

Prepare a shift handoff for the last 12 hours. List open P0 and P1 incidents,
unassigned work, ownership changes, overdue items, and investigation comments.
Do not update any records.

Write better prompts

Include five details when they matter:

Detail	Example
Time range	last 24 hours or since 2026-07-29
Scope	credential breaches in XVigil
Audience	SOC manager or CISO
Output	table with incident ID, priority, owner, and next action
Write control	show the proposed changes and wait for approval

A reusable prompt pattern:

Act as a [role]. Review [scope] for [time range]. Use CloudSEK account data and
GTI where relevant. Return [output format]. Cite the record IDs and distinguish
confirmed facts from possible associations. If a change is needed, show the
current and proposed values, wait for my approval, then verify the result.

You can also ask Show me example prompts for a CTI analyst or Show me example prompts for a CISO to get role-specific prompts from get_prompt_examples.