AI for your role

AI for Security Analysts

Spend less time triaging and more time stopping real attacks.

Get the Security Analyst brief
The shift

How AI is changing the Security Analyst role

AI is taking over the first pass of alert triage, grouping related events and explaining what likely happened in plain language. It now helps write and tune detection rules, summarize incidents for handoff, and draft response steps from past playbooks. Security Analysts in 2026 review and direct this work rather than reading every raw log line by hand.

What AI can take off your plate

  • First pass triage that groups related alerts and ranks them by likely severity
  • Drafting detection rules and queries from a described behavior
  • Writing incident summaries and timelines from raw notes
  • Enriching indicators by pulling and explaining threat intel context
  • Generating step by step response playbooks from past cases

What stays distinctly human

  • Deciding whether to escalate, contain, or stand down on a real incident
  • Judging business context and risk that tools do not see
  • Communicating with affected teams and leadership under pressure
  • Spotting novel attacker behavior that does not match known patterns
  • Owning accountability for response decisions and their consequences
Tools

Five AI tools for Security Analysts

Microsoft Security Copilot
A Security Analyst asks it to summarize an incident across Defender and Sentinel and get suggested next steps in plain language.
Try it →
CrowdStrike Charlotte AI
Used to triage endpoint detections, explain why something fired, and prioritize which hosts to investigate first.
Try it →
Splunk AI Assistant for SPL
Turns plain English questions into SPL queries so analysts can search logs without memorizing syntax.
Try it →
ChatGPT
A Security Analyst pastes a suspicious script or log snippet to get a quick explanation of what it does and whether it looks malicious.
Try it →
Tines
Builds and runs automated workflows for repetitive response tasks like enriching IOCs or opening tickets, with AI helping draft the steps.
Try it →
Prompts

Five prompts to try today

Paste these into Claude or ChatGPT and replace the bracketed parts with your own details.

1. Explain a suspicious script
Explain what this script does step by step and flag anything that looks malicious or evasive. Tell me what to check next. Script: [paste script]
2. Triage an alert
Here is an alert and its raw fields: [paste alert]. Summarize what triggered it, rate the likely severity, list false positive reasons, and give three investigation steps.
3. Write a detection rule
Write a [Sigma/SPL/KQL] detection rule for this behavior: [describe technique]. Include comments explaining each condition and note expected false positives.
4. Summarize an incident
Turn these investigation notes into a clear incident summary with timeline, impacted systems, root cause, and actions taken, written for a manager. Notes: [paste notes]
5. Enrich indicators
For these indicators [paste IPs/domains/hashes], list what to check in threat intel, what each indicator type tells me, and how to confirm if they are malicious.
The playbook

Every AI play for Security Analysts

The full library of tools, prompts, and tricks for your role — updated every week. Tap any card for a step-by-step walkthrough and examples.

✦  New tools, prompts, and tricks are added every week — and go straight to subscribers in their morning brief. Skip the scrolling and get yours delivered free. Get my free brief →
Loading the library…

A day in your inbox

This is the kind of brief a Security Analyst gets, every weekday morning.
Monday morning
✦ Personalized for: Security Analyst
Today's Tool
Triage a phishing report with Security Copilot
A user reports a suspicious email, so the analyst asks Security Copilot to pull the message, check sender reputation and links, and summarize the risk. It returns a short verdict and the affected mailboxes in under a minute.
👍 More like this·👎 Less like this·★ Save
Today's Prompt
Confirm the scope
Paste this into your assistant: "This phishing email reached [number] users. Tell me what to search to find who clicked, what to check on those endpoints, and how to confirm credential theft."
👍 More like this·👎 Less like this·★ Save
Today's Trick
Always ask for false positive reasons
When the AI rates an alert, also ask it to list why it might be benign. This keeps you from acting on a confident but wrong answer and points you to the exact fields to verify.
👍 More like this·👎 Less like this·★ Save
Today’s three are just the start — go deeper on your role.
Browse all playbooks →

Get the Security Analyst brief

One AI tool, one prompt, and one trick for Security Analysts, every weekday morning. Free.

You’re in! We just emailed your first brief — it should land in a minute. Add [email protected] to your contacts so it never hits spam.
Free forever. Unsubscribe anytime. We use your role only to personalize your brief.