Isolation, account disablement, firewall changes, and case closure alter real systems. A triage prompt may propose an action with target identity, supporting evidence, expected service impact, rollback path, and playbook owner. It must not issue the action without current authorization. Before execution, recheck that the asset and account still match the case and preserve required evidence. After an effect, record the tool receipt and verify the actual state; an ambiguous timeout requires receipt lookup before retry. Continue monitoring because containment is not the same as recovery or root-cause resolution.
Make this comfortable
Security alert prompts: gate containment and verify receipts
Operational case
Orion considers isolating H-47 after the unexplained sign-in. The analyst first checks whether the workstation is operating a live dispatch shift and confirms the host ID. The proposal includes the supporting identity events and the potential interruption to scheduling. The authorized responder chooses a reversible measure. If the isolation call times out, the assistant checks the endpoint tool's operation record rather than sending a second command. A confirmed receipt says what changed; the case remains open for investigation.
Proposal: isolate H-47 pending responder review
Evidence: identity event IDs and asset record version
Impact: dispatch workstation may lose connectivity
Authorization: current responder required
Timeout: query operation receipt before retry
Case status: open after containmentPerformance and review cost
Preparing G case packets is O(G + E) for G cases and E cited events. Receipt lookup is O(1) average with an operation key. Human authorization and state verification cost time but prevent wrong-host isolation and duplicate effects. The response packet should be short enough to inspect during an incident while retaining raw event pointers, action identity, approval, and observed result.
Common Mistakes
- Do not execute isolation from an unreviewed model suggestion.
- Do not retry an ambiguous effect without checking its receipt.
- Do not describe containment as complete recovery.
Connected lessons
- Production prompt engineering
- Prompt Engineering
- Tool effects: reconcile receipts before retrying
- Incident resolution: verify recovery and correct the record
- Security alert prompts: preserve event provenance and time
- Security alert prompts: group repeated signals without erasing events
- Security alert prompts: test benign explanations before escalation
- Security alert prompts: apply scoped severity and escalation rules
- Security alert prompts: quarantine instructions embedded in logs
- Project: triage Orion authentication alerts
- Security-alert triage decisions
prompt engineering
security triage