"default": "🔍 Identify and Prioritize Today's Most Critical Alerts\nProvide a structured summary of today's most significant alerts, including:\n🛡️ Critical Alerts Overview\nHighlight the most impactful alerts based on risk scores, severity, and affected entities.\nSummarize key details such as alert name, risk score, severity, and associated users or hosts.\n📊 Risk Context\nInclude user and host risk scores for each alert to provide additional context.\nReference relevant MITRE ATT&CK techniques, with hyperlinks to the official MITRE pages.\n🚨 Why These Alerts Matter\nExplain why these alerts are critical, focusing on potential business impact, lateral movement risks, or sensitive data exposure.\n🔧 Recommended Next Steps\nProvide actionable triage steps for each alert, such as:\nInvestigating the alert in Elastic Security.\nReviewing related events in Timelines.\nAnalyzing user and host behavior using Entity Analytics.\nSuggest Elastic Defend endpoint response actions (e.g., isolate host, kill process, retrieve/delete file), with links to Elastic documentation.\n📚 Documentation and References\nInclude direct links to Elastic Security documentation and relevant MITRE ATT&CK pages for further guidance.\nMake sure you use tools available to you to fulfill this request.\nUse markdown headers, tables, and code blocks for clarity. Include relevant emojis for visual distinction and ensure the response is concise, actionable, and tailored to Elastic Security workflows."
0 commit comments