Find the facts.
Leave a useful handoff.

A guided notebook for the alert in front of you. Keep observations, assumptions and unanswered questions separate.

What brought you here?

Select a narrow scenario, then define the alert and investigation boundary.

Investigation scenario Case summaryOne sentence describing the question, not a conclusion. Alert / case referenceA reference your next analyst can retrieve. Affected scopeKnown accounts, hosts, services or resources. Time window and coverageInclude timezone, sources available and known retention gaps.

The example replaces the current worksheet only after confirmation. All example records are fictional.

What should you check?

Read this scenario's field guide

A recorded check is not a safety score. Add a source or evidence ID, including what the source could not show.

What did you observe?

One source-backed observation per entry. The timeline orders known UTC times; unknown times stay visibly separate.

No evidence recorded. Start with the original event.

What does the next analyst need?

Write what is known and what remains uncertain. Follow your team's escalation criteria and response authority.

HypothesesPossible explanations, with the evidence that would support or weaken them.Benign explanations to verifyGaps and not checkedSeparate unavailable evidence from searches with no matching results. Include query scope and retention.Actions actually takenRecord actor, time, result and authorization. Put proposed actions in the next field.Escalation questions and requested next stepNext owner and review timeUse a team/role or assigned owner. No automatic assignment occurs.

Review before handing off.

Generate the full ticket preview. Markdown and JSON downloads include all worksheet text, without redaction. Use your approved case system.

I reviewed this full export and its destination. It may contain sensitive case data.

Optional: prepare a redacted AI review prompt

This path does not copy your case text. Write a separate, minimal summary with aliases such as user-A and host-B. It is your responsibility to approve external sharing under your organization's policy.

Pattern masking covers some credentials, URLs, emails and IPv4 addresses. It misses names, internal hosts, IPv6, arbitrary secrets and context-sensitive data. Explicit removal terms and human review are still required.

Shareable summarySupply only approved, pseudonymized facts. Keep raw logs, access tokens and session secrets out.Additional exact text to removeOne term per line. Case-insensitive literal matching, including within words.

I reviewed every line of this exact prompt, removed sensitive details, and am allowed to share it.

No model runs here. No external calls are made. A prompt cannot guarantee another model's behavior or the correctness of its answer.