For Cybersecurity Analysts ·
What you'll accomplish
Claude Pro becomes your dedicated incident report writer, turning rough investigation notes into complete, professional reports in under 5 minutes. Your time goes to investigating, not formatting prose.
What you'll need
Go to claude.ai and sign up with your work email. Click "Upgrade" and select the Pro plan. Claude Pro gives you a much longer context window, which is essential for pasting full investigation timelines, log extracts, and detailed notes.
What you should see: The Claude chat interface. You'll see your subscription status in the account menu.
Find or create your organization's standard incident report template. If you don't have one, use this structure:
The key to making this fast is taking notes in a consistent format during your investigation. Create a simple notes template:
INCIDENT NOTES
Date/Time Discovered:
Alert Type:
Initial Alert Details:
[Timeline - add events as you discover them]
[timestamp] - [what you found]
[timestamp] - [action taken]
Affected Systems:
-
IOCs Found:
-
Actions Taken:
-
Still Outstanding:
-
Open claude.ai. In the chat, paste this system prompt to start the conversation:
"You are a cybersecurity incident report writer. I will give you my raw investigation notes and you will produce a professional, formal incident report. Use the following template structure: [paste your template]. Write in third person, professional tone. Do not invent details, only use what I give you. If information is missing, use [PLACEHOLDER] so I know to fill it in."
Then paste your investigation notes and ask: "Draft an incident report from these notes."
What you should see: A complete, formatted incident report that pulls all information from your notes into the proper sections. Missing information will be clearly marked as [PLACEHOLDER].
After getting the initial report, ask Claude to produce a second version: "Now write a 3-bullet-point executive summary of this incident for our CISO who will read it on their phone."
You now have both a detailed report and a short executive summary from one set of notes.
Copy the prompt you used to start the conversation. Save it in a notes file or document. Each time you need to write a report, start a new Claude conversation, paste your prompt template, and then paste your investigation notes. The setup takes 30 seconds.
Basic incident report:
Draft a formal incident report from these notes. Include: Executive Summary, Timeline, Affected Systems, Root Cause, Actions Taken, Recommendations. Notes: [paste your notes]
Executive-only summary:
Write a 3-sentence executive summary of this incident for the CISO: [paste incident description]. Focus on what happened, business impact, and what was done to resolve it. No technical jargon.
Lessons learned section:
Based on this incident [paste brief description], write a "Lessons Learned" section covering: what we detected well, what we should have caught faster, and 3 specific process improvements to prevent recurrence.
Post-incident communications:
Write a notification email to the affected user [jsmith] explaining that their credentials were compromised in a phishing attack, what actions we took, and what they need to do now (change password, verify account activity).