AI Skill Report Card
Defending Against Cyber Attacks
Cyber Defense Agent
Quick Start13 / 15
Given an incident description or a system to defend, produce four sections in this order: Defense Plan → Detection Flow → Response Flow → Recovery Plan. Always ground recommendations in the actual context provided (assets, logs, indicators); do not output generic boilerplate unrelated to the case.
Example trigger: "We see unusual outbound traffic from a web server at 2 AM, possible C2 beaconing."
Recommendation▾
Add an example for a different threat class like ransomware or DDoS to show broader coverage
Workflow14 / 15
Progress:
- Step 1: Clarify scope — what asset/system/network is involved, what evidence exists (logs, alerts, IOCs)
- Step 2: Classify the threat type (intrusion, malware, phishing, DDoS, insider, data exfiltration, ransomware, etc.)
- Step 3: Build the Defense Plan — preventive controls, hardening steps, monitoring gaps to close
- Step 4: Build the Detection Flow — how the threat is/would be identified, in ordered steps (log sources → correlation → alert triggers → triage)
- Step 5: Build the Response Flow — containment → eradication → communication, in ordered steps with clear owners/actions
- Step 6: Build the Recovery Plan — restoration steps, validation, post-incident hardening, lessons-learned
- Step 7: Flag any assumptions made due to missing information
Recommendation▾
Include a severity/triage classification framework (e.g., P1-P4) to guide prioritization decisions
Output Format
Always structure the final answer as:
Defense Plan
- [Preventive controls, hardening, policy recommendations]
Detection Flow
- [Step] → 2. [Step] → 3. [Step] ... (Include data sources: SIEM, EDR, firewall logs, IDS/IPS, etc.)
Response Flow
- Containment: ...
- Eradication: ...
- Communication/Escalation: ...
Recovery Plan
- Restoration steps
- Validation/testing before going back to production
- Post-incident review and hardening actions
Examples18 / 20
Example 1: Input: "Suspicious outbound traffic from a web server, port 443 to unknown IP, at odd hours."
Output:
Recommendation▾
Add guidance on legal/regulatory notification requirements (breach disclosure timelines) as part of Communication step
Defense Plan
- Enforce egress filtering; whitelist known destinations for the web server
- Deploy EDR agent on the host if not present
- Segment web server from internal network (DMZ isolation)
- Enable full packet capture on suspicious segment
Detection Flow
- SIEM correlation rule triggers on anomalous outbound connection (unusual destination/time)
- Cross-reference destination IP against threat intel feeds
- Check DNS logs for beaconing pattern (periodic, low-jitter requests)
- Confirm via EDR process tree on the host for the initiating process
- Escalate to Tier 2 analyst if IOC match found
Response Flow
- Containment: Isolate host from network (block egress at firewall, disable NIC if critical)
- Eradication: Identify and kill malicious process; remove persistence mechanisms (scheduled tasks, cron, registry run keys)
- Communication: Notify incident commander and stakeholders; open incident ticket with severity rating
Recovery Plan
- Rebuild host from known-good image if compromise confirmed
- Rotate credentials/secrets stored/accessible on the host
- Validate with vulnerability scan + EDR sweep before returning to production
- Post-incident: review egress rules, add detection rule for this specific C2 pattern, brief team
**Example 2:**
Input: "Employee reports phishing email with a malicious attachment, unsure if opened."
Output:
Defense Plan
- Enforce attachment sandboxing at mail gateway
- Mandatory security awareness training on phishing
- Disable macro execution by default org-wide
Detection Flow
- Retrieve email from mail server logs; extract hash of attachment
- Check hash against threat intel / sandbox detonation
- Search EDR/SIEM for the hash or related process execution on employee's endpoint
- Check for lateral movement indicators if execution confirmed
Response Flow
- Containment: Isolate employee's endpoint from network pending analysis
- Eradication: If malware confirmed, remove artifacts, block hash/domain org-wide
- Communication: Alert affected user, notify IT security team, inform other users if mass phishing campaign detected
Recovery Plan
- Reimage endpoint if compromise confirmed
- Reset employee credentials
- Verify no further spread via EDR sweep
- Update email filters with new IOCs; log lessons learned
Best Practices
- Always tie the Detection Flow to concrete, plausible data sources (SIEM, EDR, firewall, DNS, IDS/IPS) rather than vague statements like "monitor systems."
- Order Response Flow using standard IR phases: Identification → Containment → Eradication → Recovery → Lessons Learned (Detection/Recovery split out separately here).
- State assumptions explicitly when input lacks detail (e.g., "assuming no EDR is deployed, recommend...").
- Prioritize actions by urgency — containment steps first, then deeper investigation.
- Keep each section actionable — every bullet should be something a responder can execute, not abstract theory.
Common Pitfalls
- Do not skip straight to "Recovery Plan" without containment — this risks re-infection.
- Do not give a single generic answer for all attack types; tailor Defense/Detection/Response to the specific threat (ransomware ≠ phishing ≠ DDoS).
- Do not omit communication/escalation steps in Response Flow — technical fixes without stakeholder notification are incomplete.
- Do not assume tools (EDR, SIEM) exist without stating the assumption — recommend acquiring them if absent.
- Avoid vague verbs ("investigate further") without specifying what to check and where.