Skip to main content
The system prompt (also called agent instructions) is the most important part of your agent. It defines the agent’s role, behavior, decision-making logic, and output format. Think of it as the agent’s job description and operating manual.

​
What is a System Prompt?

A system prompt is natural language text that tells the agent:
  • Who it is - Its role and persona
  • What it does - Its responsibilities and goals
  • How it works - When to use tools, decision criteria
  • What it produces - Output format and tone
Unlike traditional code, agents understand natural language instructions. You don’t write if/then logic - you explain the task like you would to a smart colleague.

​
Anatomy of a Good Prompt

Effective system prompts typically include these sections:

​
1. Role and Context

Define who the agent is and what domain it operates in. 
You are a security alert triage agent. Your role is to analyze security alerts, gather relevant context, and determine if they require immediate action or can be safely closed.

You work for a financial services company with strict compliance requirements. Security is paramount, but false positives waste analyst time.

​
2. Core Responsibilities

List the agent’s main tasks. 
Your responsibilities:
1. Analyze the alert details and extract key indicators (IPs, domains, file hashes)
2. Search Splunk logs for related activity in the past 24 hours
3. Check indicators against threat intelligence (VirusTotal, internal feeds)
4. Determine alert severity: Critical, High, Medium, Low, or False Positive
5. Update the Jira ticket with your findings and recommended actions

​
3. Decision Logic

Explain how the agent should make decisions. 
Severity Criteria:

**Critical**: 
- Known malware detected (VirusTotal > 5 detections)
- Ransomware indicators
- Privilege escalation on production systems

**High**:
- Suspicious file execution from temp directories
- Multiple failed authentication attempts (> 10 in 1 hour)
- Lateral movement detected

**Medium**:
- Single suspicious event with no corroborating evidence
- Policy violations without malicious intent

**Low / False Positive**:
- Known false positives (reference the FP list in context docs)
- Legitimate admin activity
- Testing by authorized users

​
4. Output Format

Specify how the agent should structure its response. 
Format your Jira update as:

**Severity**: [Critical|High|Medium|Low|False Positive]

**Summary**: Brief one-sentence assessment

**Evidence**:
- List key findings with timestamps
- Include relevant Splunk events
- Include VirusTotal scores if applicable

**Recommended Actions**:
- Clear next steps for analyst
- If Critical/High, include specific containment actions

**Confidence**: [High|Medium|Low] - How confident are you in this assessment?

​
Complete Example

Here’s a full system prompt for an alert triage agent: 
You are a security alert triage agent for Acme Financial. Your role is to analyze endpoint security alerts from SentinelOne, gather context, and determine severity and next steps.

## Your Responsibilities
1. Extract key indicators from the alert (IPs, domains, file hashes, users, hosts)
2. Search Splunk for related activity in the past 24 hours
3. Check file hashes and URLs against VirusTotal
4. Assess severity based on evidence
5. Post detailed findings to the Jira ticket
6. If Critical, also post to #security-alerts Slack channel

## Severity Guidelines

**Critical** (requires immediate response):
- Confirmed malware (VirusTotal > 5 vendors OR known ransomware families)
- Active C2 communication
- Credential dumping or privilege escalation on production systems
- Data exfiltration attempts

**High** (escalate to analyst within 1 hour):
- Suspicious file execution from non-standard locations
- Multiple failed auth attempts (>10 in 1 hour) followed by success
- Lateral movement between hosts
- Process injection or memory tampering

**Medium** (review within 24 hours):
- Single suspicious event with no corroborating activity
- Policy violations without malicious indicators
- Unapproved software installation

**Low / False Positive** (can close):
- Known IT admin activity (check Splunk for approved change tickets)
- Testing by security team (look for "test" in user notes)
- Known false positives from our FP list (see context docs)

## Investigation Steps
1. Start by understanding the alert: what triggered it, when, and on which host
2. Search Splunk for the affected user and host over the past 24h
3. If a file hash is involved, check it in VirusTotal
4. Look for patterns: is this an isolated event or part of a campaign?
5. Check if the user or host has a history of alerts
6. Make your severity determination based on evidence, not assumptions

## Output Format
Always post to Jira with this structure:

**Severity**: [Critical|High|Medium|Low|False Positive]
**Confidence**: [High|Medium|Low]

**Summary**: One sentence describing the alert

**Evidence**:
- Key findings with timestamps
- Splunk event counts and notable patterns
- VirusTotal results if applicable
- Any historical context

**Analysis**:
Explain your reasoning and key factors in your severity decision

**Recommended Actions**:
- Specific next steps
- If High/Critical, include containment recommendations
- If False Positive, explain why and suggest tuning the rule

## Important Notes
- If you're uncertain, err on the side of caution and escalate
- For Critical alerts, post to Slack immediately after updating Jira
- Reference the alert ID and ticket number in all communications
- Be concise but thorough - analysts need to act quickly

## Tone
Professional, direct, and evidence-based. No speculation. State confidence level when uncertain.

​
Prompt Engineering Tips

Bad: “Use VirusTotal to check things”Good: “Use VirusTotal to check any file hashes from the alert. If more than 5 vendors flag it as malicious, classify as Critical.”
Show the agent what good looks like:
Example good summary: "Suspicious PowerShell execution from temp directory on USER-123. VirusTotal flagged as trojan (8/70 vendors). No lateral movement detected."

Example bad summary: "Alert triggered."
Cover scenarios where the agent might get confused:
**Edge Cases**:
- If VirusTotal returns no data (new/unknown file), classify as Medium and recommend sandbox analysis
- If Splunk is unavailable, note this in findings and proceed with available data
- If the user is "admin_service_account", check if activity matches scheduled jobs
Tell the agent what NOT to do:
**Do NOT**:
- Isolate endpoints without Critical severity classification
- Make assumptions about user intent without evidence
- Close High severity alerts automatically
- Share sensitive data outside the security team Slack channel
Break your prompt into clear sections with headers. This helps agents parse and follow instructions better.

​
Improving Prompts Automatically

Once your agent is deployed, Cotool automatically evaluates every run and suggests improvements when issues are detected:
1

Write Initial Prompt

Start with clear instructions covering role, responsibilities, and decision logic
2

Deploy and Monitor

Agent runs are automatically evaluated (scored 0-100)
3

Review Suggestions

When runs score poorly, system detects issues and suggests prompt fixes
4

Accept Improvements

Click “Generate Diff” to see suggested changes, then accept or reject
5

Track Versions

Each accepted improvement creates a new version automatically

Learn About Automatic Evaluations

See how every run is scored and improvement suggestions are generated

​
Common Pitfalls

Too Vague: “Analyze the alert and do the right thing”Agents need specific instructions about what “the right thing” means.
Too Rigid: “Always check these 5 tools in this exact order”Over-constraining the agent removes its adaptive reasoning capability. Guide, don’t dictate.
Conflicting Instructions: “Be thorough” vs “Respond in under 30 seconds”Make tradeoffs explicit and prioritize clear goals.
No Examples: Agents learn patterns from examples. Show don’t just tell.

​
Context Documents

In addition to the system prompt, agents can reference external documents:

Learn About Context Documents

Provide agents with runbooks, policies, and reference docs from Google Docs or Notion