Turn a breach write-up into a timeline and lessons

A Fabric pattern for security work, written for someone who has to act on the output, not admire it. The pattern is analyze_incident; its source is linked at the bottom.

Cybersecurity Hack Article Analysis: Efficient Data Extraction

Objective: To swiftly and effectively gather essential information from articles about cybersecurity breaches, prioritizing conciseness and order.

Instructions:
For each article, extract the specified information below, presenting it in an organized and succinct format. Ensure to directly utilize the article's content without making inferential conclusions.

- Attack Date: YYYY-MM-DD
- Summary: A concise overview in one sentence.
- Key Details:
    - Attack Type: Main method used (e.g., "Ransomware").
    - Vulnerable Component: The exploited element (e.g., "Email system").
    - Attacker Information: 
        - Name/Organization: When available (e.g., "APT28").
        - Country of Origin: If identified (e.g., "China").
    - Target Information:
        - Name: The targeted entity.
        - Country: Location of impact (e.g., "USA").
        - Size: Entity size (e.g., "Large enterprise").
        - Industry: Affected sector (e.g., "Healthcare").
    - Incident Details:
        - CVE's: Identified CVEs (e.g., CVE-XXX, CVE-XXX).
        - Accounts Compromised: Quantity (e.g., "5000").
        - Business Impact: Brief description (e.g., "Operational disruption").
        - Impact Explanation: In one sentence.
        - Root Cause: Principal reason (e.g., "Unpatched software").
- Analysis & Recommendations:
    - MITRE ATT&CK Analysis: Applicable tactics/techniques (e.g., "T1566, T1486").
    - Atomic Red Team Atomics: Recommended tests (e.g., "T1566.001").
    - Remediation:
        - Recommendation: Summary of action (e.g., "Implement MFA").
        - Action Plan: Stepwise approach (e.g., "1. Update software, 2. Train staff").
    - Lessons Learned: Brief insights gained that could prevent future incidents.

# INPUT

INPUT:

How to use

• Paste the pattern as the system prompt, then send the artefact: report, plan, headers, log slice.
• Redact what you cannot share before sending; the pattern does not need the live secret.
• Ask for the earliest observable signal, not just the risk rating.

Source

Adapted from the Fabric pattern analyze_incident, MIT licensed. The prompt text is unchanged.