From c6c30aa1eebcc6ba7bfee8e36febf17895ff8d16 Mon Sep 17 00:00:00 2001
From: Joas A Santos <34966120+CyberSecurityUP@users.noreply.github.com>
Date: Tue, 16 Dec 2025 21:05:18 -0300
Subject: [PATCH] Create prompt-04.md

---
 Blue Team/prompt-04.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 Blue Team/prompt-04.md

diff --git a/Blue Team/prompt-04.md b/Blue Team/prompt-04.md
new file mode 100644
index 0000000..672923b
--- /dev/null
+++ b/Blue Team/prompt-04.md	
@@ -0,0 +1,16 @@
+Act as a SOC analyst investigating a suspected phishing URL: <URL>
+
+Email context:
+- Sender: <FROM>
+- Subject: <SUBJECT>
+- Received time: <TIME>
+- Targeted users: <COUNT/DEPT>
+- Any attachments? <YES/NO + TYPE>
+- User interaction: <CLICKED/OPENED/CREDENTIALS_ENTERED/UNKNOWN>
+
+Deliver:
+- Phishing likelihood assessment (with reasons)
+- What to hunt in email gateway logs (message IDs, similar subjects, lookalike senders)
+- What to hunt in proxy/DNS after the email time window
+- Containment playbook (user actions + technical blocks)
+- Communication snippet to send users (2–3 lines, non-technical)