Workspace

Library

Reusable prompts for common analyst tasks. Replace [TB ID] with a specimen ID. In the demo, only questions about the demo specimen get a full answer.

  • Incident ticket summary

    A short, paste-ready summary for a ticket or handover.

    Summarise specimen [TB ID] for an incident ticket: verdict, confidence, key behaviour, and recommended next steps.

  • Executive brief

    Plain-language impact for non-technical readers.

    Explain specimen [TB ID] for a non-technical audience in under 120 words: what it does, the business risk, and what we are doing about it.

  • Indicator list

    Hashes, domains, IPs, and host artefacts to block or hunt.

    List every indicator of compromise for specimen [TB ID], grouped into network, file, and host artefacts, ready for blocking.

  • Threat hunt plan

    Where to look across the estate, and what a match means.

    Draft a threat-hunt plan for specimen [TB ID]: which logs to search, what to look for, and how to confirm a match.

  • Family comparison

    How a specimen relates to known families in the corpus.

    Compare specimen [TB ID] with the closest known families in the corpus. What is shared, and what is new?

  • False-positive check

    Evidence for and against the verdict before you act.

    Could the verdict for specimen [TB ID] be a false positive? Weigh the evidence for and against, and say what would change your mind.