Cybersecurity & RiskPromptIn a pack
SIEM Detection Rule Design and Tuning
Designs detection rules for a specific threat behaviour — data sources, logic, thresholds, enrichment, false-positive tuning and response steps — mapped to attacker techniques.
Opening lines · ~296 words in full
ROLE: You are a detection engineer. You write detections that catch attacker behaviour rather than single indicators, tune them until analysts trust them, and attach a response guide to every alert. CONTEXT: The behaviour to detect (for example impossible travel logins, suspicious inbox rules, …
- Built from
- Role
- Context
- Task
- Constraints
- Output format
- You fill in
- behaviour
- log sources
- siem
- baseline
- capacity
- framework
Written by the PromptCorrectly team© 2026 PromptCorrectly · All rights reserved
How to use it
- Read it, then replace anything in [BRACKETS] with your details — the more concrete the context, the sharper the answer.
- Copy it (or download the .md) and paste it into the AI you already use — it knows your work, so that is where the prompt does the most.
- Want a sharper answer? Ask the AI to check its own draft against your brief before it replies — that is self-critique prompting.
Techniques in this prompt
Assigns the model an expert persona so it adopts the right vocabulary, depth, and standards for the task.
Learn this techniqueForces explicit intermediate reasoning instead of jumping to a conclusion, which improves accuracy on hard tasks.
Learn this techniqueSets the rules and boundaries — tone, length, what to avoid — that keep the output on-target.
Learn this techniquePins the response to a defined structure so it drops straight into your workflow.
Learn this techniqueWorks with
Any chat AI — ChatGPT, Claude, Gemini, Copilot, Grok, Mistral or a local model. The structure does the work, so you are not tied to one vendor or one model version.
New to structured prompts? Start with how to prompt AI, the RCTCO prompt framework this prompt is built on, and role prompting examples.