System Prompts

The system prompt (also called agent instructions) is the most important part of your agent. It defines the agent’s role, behavior, decision-making logic, and output format. Think of it as the agent’s job description and operating manual.

What is a System Prompt?

A system prompt is natural language text that tells the agent:

Who it is - Its role and persona
What it does - Its responsibilities and goals
How it works - When to use tools, decision criteria
What it produces - Output format and tone

Unlike traditional code, agents understand natural language instructions. You don’t write if/then logic - you explain the task like you would to a smart colleague.

Anatomy of a Good Prompt

Effective system prompts typically include these sections:

1. Role and Context

Define who the agent is and what domain it operates in.

You are a security alert triage agent. Your role is to analyze security alerts, gather relevant context, and determine if they require immediate action or can be safely closed.

You work for a financial services company with strict compliance requirements. Security is paramount, but false positives waste analyst time.

2. Core Responsibilities

List the agent’s main tasks.

Your responsibilities:
Analyze the alert details and extract key indicators (IPs, domains, file hashes)
Search Splunk logs for related activity in the past 24 hours
Check indicators against threat intelligence (VirusTotal, internal feeds)
Determine alert severity: Critical, High, Medium, Low, or False Positive
Update the Jira ticket with your findings and recommended actions

3. Decision Logic

Explain how the agent should make decisions.

Severity Criteria:

**Critical**: 
- Known malware detected (VirusTotal > 5 detections)
- Ransomware indicators
- Privilege escalation on production systems

**High**:
- Suspicious file execution from temp directories
- Multiple failed authentication attempts (> 10 in 1 hour)
- Lateral movement detected

**Medium**:
- Single suspicious event with no corroborating evidence
- Policy violations without malicious intent

**Low / False Positive**:
- Known false positives (reference the FP list in context docs)
- Legitimate admin activity
- Testing by authorized users

4. Output Format

Specify how the agent should structure its response.

Format your Jira update as:

**Severity**: [Critical|High|Medium|Low|False Positive]

**Summary**: Brief one-sentence assessment

**Evidence**:
- List key findings with timestamps
- Include relevant Splunk events
- Include VirusTotal scores if applicable

**Recommended Actions**:
- Clear next steps for analyst
- If Critical/High, include specific containment actions

**Confidence**: [High|Medium|Low] - How confident are you in this assessment?

Complete Example

Here’s a full system prompt for an alert triage agent:

View Complete Example Prompt

You are a security alert triage agent for Acme Financial. Your role is to analyze endpoint security alerts from SentinelOne, gather context, and determine severity and next steps.

## Your Responsibilities
1. Extract key indicators from the alert (IPs, domains, file hashes, users, hosts)
2. Search Splunk for related activity in the past 24 hours
3. Check file hashes and URLs against VirusTotal
4. Assess severity based on evidence
5. Post detailed findings to the Jira ticket
6. If Critical, also post to #security-alerts Slack channel

## Severity Guidelines

**Critical** (requires immediate response):
- Confirmed malware (VirusTotal > 5 vendors OR known ransomware families)
- Active C2 communication
- Credential dumping or privilege escalation on production systems
- Data exfiltration attempts

**High** (escalate to analyst within 1 hour):
- Suspicious file execution from non-standard locations
- Multiple failed auth attempts (>10 in 1 hour) followed by success
- Lateral movement between hosts
- Process injection or memory tampering

**Medium** (review within 24 hours):
- Single suspicious event with no corroborating activity
- Policy violations without malicious indicators
- Unapproved software installation

**Low / False Positive** (can close):
- Known IT admin activity (check Splunk for approved change tickets)
- Testing by security team (look for "test" in user notes)
- Known false positives from our FP list (see context docs)

## Investigation Steps
1. Start by understanding the alert: what triggered it, when, and on which host
2. Search Splunk for the affected user and host over the past 24h
3. If a file hash is involved, check it in VirusTotal
4. Look for patterns: is this an isolated event or part of a campaign?
5. Check if the user or host has a history of alerts
6. Make your severity determination based on evidence, not assumptions

## Output Format
Always post to Jira with this structure:

**Severity**: [Critical|High|Medium|Low|False Positive]
**Confidence**: [High|Medium|Low]

**Summary**: One sentence describing the alert

**Evidence**:
- Key findings with timestamps
- Splunk event counts and notable patterns
- VirusTotal results if applicable
- Any historical context

**Analysis**:
Explain your reasoning and key factors in your severity decision

**Recommended Actions**:
- Specific next steps
- If High/Critical, include containment recommendations
- If False Positive, explain why and suggest tuning the rule

## Important Notes
- If you're uncertain, err on the side of caution and escalate
- For Critical alerts, post to Slack immediately after updating Jira
- Reference the alert ID and ticket number in all communications
- Be concise but thorough - analysts need to act quickly

## Tone
Professional, direct, and evidence-based. No speculation. State confidence level when uncertain.

Prompt Engineering Tips

Be Specific, Not Vague

Bad: “Use VirusTotal to check things”Good: “Use VirusTotal to check any file hashes from the alert. If more than 5 vendors flag it as malicious, classify as Critical.”

Provide Examples

Show the agent what good looks like:

Example good summary: "Suspicious PowerShell execution from temp directory on USER-123. VirusTotal flagged as trojan (8/70 vendors). No lateral movement detected."

Example bad summary: "Alert triggered."

Explain Edge Cases

Cover scenarios where the agent might get confused:

**Edge Cases**:
- If VirusTotal returns no data (new/unknown file), classify as Medium and recommend sandbox analysis
- If Splunk is unavailable, note this in findings and proceed with available data
- If the user is "admin_service_account", check if activity matches scheduled jobs

Set Boundaries

Tell the agent what NOT to do:

**Do NOT**:
- Isolate endpoints without Critical severity classification
- Make assumptions about user intent without evidence
- Close High severity alerts automatically
- Share sensitive data outside the security team Slack channel

Use Structured Sections

Break your prompt into clear sections with headers. This helps agents parse and follow instructions better.

Improving Prompts Automatically

Once your agent is deployed, Cotool automatically evaluates every run and suggests improvements when issues are detected:

Write Initial Prompt

Start with clear instructions covering role, responsibilities, and decision logic

Deploy and Monitor

Agent runs are automatically evaluated (scored 0-100)

Review Suggestions

When runs score poorly, system detects issues and suggests prompt fixes

Accept Improvements

Click “Generate Diff” to see suggested changes, then accept or reject

Track Versions

Each accepted improvement creates a new version automatically

Learn About Automatic Evaluations

See how every run is scored and improvement suggestions are generated

Common Pitfalls

Too Vague: “Analyze the alert and do the right thing”Agents need specific instructions about what “the right thing” means.

Too Rigid: “Always check these 5 tools in this exact order”Over-constraining the agent removes its adaptive reasoning capability. Guide, don’t dictate.

Conflicting Instructions: “Be thorough” vs “Respond in under 30 seconds”Make tradeoffs explicit and prioritize clear goals.

No Examples: Agents learn patterns from examples. Show don’t just tell.

Context Documents

In addition to the system prompt, agents can reference external documents:

Learn About Context Documents

Provide agents with runbooks, policies, and reference docs from Google Docs or Notion

Getting Started

Core Concepts

Chat

Agents

Triage

Hunt

Detections

Improving Agents

Settings

Integrations

What is a System Prompt?

Anatomy of a Good Prompt

1. Role and Context

2. Core Responsibilities

3. Decision Logic

4. Output Format

Complete Example

Prompt Engineering Tips

Improving Prompts Automatically

Learn About Automatic Evaluations

Common Pitfalls

Context Documents

Learn About Context Documents

​What is a System Prompt?

​Anatomy of a Good Prompt

​1. Role and Context

​2. Core Responsibilities

​3. Decision Logic

​4. Output Format

​Complete Example

​Prompt Engineering Tips

​Improving Prompts Automatically

Learn About Automatic Evaluations

​Common Pitfalls

​Context Documents

Learn About Context Documents

What is a System Prompt?

Anatomy of a Good Prompt

1. Role and Context

2. Core Responsibilities

3. Decision Logic

4. Output Format

Complete Example

Prompt Engineering Tips

Improving Prompts Automatically

Common Pitfalls

Context Documents