A bilingual cybersecurity prompt library for practitioners.
Una biblioteca bilingüe de prompts de ciberseguridad para profesionales.
___________ __ __ ___ ____ ____ __ ____ ____
|__ __| / _\ \/ / / __|| _ \|_ _|| \/ |/ _\ | _ \
| | | | |\ / /| | _|| |_) || | | |\/| | | || |_) |
| | | |__/ | | | |__| | _ < | | | | | |__| || _ <
|__| \____/|_| \____||_| \_\___||_| |_|\____/|_| \_\
Cybersecurity prompt library — battle-tested | thegr8val
TGV-Grimoire is a curated collection of LLM prompts engineered for cybersecurity practitioners — analysts, threat hunters, detection engineers, and red teamers who leverage AI in their daily workflows.
Every prompt is:
| Property | Detail |
|---|---|
| 🧪 Battle-tested | Used in real or lab environments |
| 🗂️ Documented | Author · use case · model tested · language · tags |
| 🔁 Ready to use | Fill [PLACEHOLDERS] and send |
| 🌐 Bilingual | English primary, [ES] sections throughout |
TGV-Grimoire/
│
├── 🎯 hunting/ ── 11 prompts
│ ├── llm-analysis/ ── Chat-mode: IOC triage, actor profiling, log analysis
│ └── automation-api/ ── API-mode: KQL/Sigma/YARA/SPL generation
│
├── 🦠 malware-analysis/ ── 3 prompts
│ ├── llm-analysis/ ── String deobfuscation, C2 fingerprinting
│ └── automation-api/ ── Packer identification, YARA rule gen
│
├── 🗡️ red-team/ ── 3 prompts
│ ├── llm-analysis/ ── Tabletop exercise builder
│ └── automation-api/ ── Detection gap analysis
│
├── 🔍 osint/ ── 3 prompts
│ ├── llm-analysis/ ── Passive recon, persona analysis
│ └── automation-api/ ── Lookalike domain generation
│
├── 📋 reporting/ ── 3 prompts
│ ├── llm-analysis/ ── Executive summaries, postmortems
│ └── automation-api/ ── Findings → remediation tickets
│
└── 🛡️ blue-team/ ── 3 prompts
├── llm-analysis/ ── Detection rule review, response playbooks
└── automation-api/ ── Crown jewels mapping
| Module | Prompts | Best For |
|---|---|---|
🎯 /hunting |
11 | IOC triage · Sigma/YARA/KQL/SPL generation · actor profiling |
🦠 /malware-analysis |
3 | String deobfuscation · C2 fingerprinting · packer ID |
🗡️ /red-team |
3 | Tabletop exercises · detection gap analysis |
🔍 /osint |
3 | Passive recon · persona analysis · lookalike domains |
📋 /reporting |
3 | Executive summaries · postmortems · remediation tickets |
🛡️ /blue-team |
3 | Detection review · response playbooks · crown jewels |
┌──────────────────────────────────┬──────────────────────────────────┐
│ 💬 llm-analysis/ │ ⚙️ automation-api/ │
│ │ │
│ For direct LLM chat │ For programmatic API use │
│ Feed data → structured analysis │ Output is JSON/YAML/KQL/Sigma │
│ Narrative, actionable │ No prose — machine-parseable │
└──────────────────────────────────┴──────────────────────────────────┘
git clone https://github.com/TheGr8Val/TGV-Grimoire.git
cd TGV-Grimoire/hunting/llm-analysisOpen any .md file, substitute [PLACEHOLDER] values, and send to your model of choice (Claude, GPT-4o, Gemini, etc.).
Every prompt starts with:
---
title: "Prompt title"
author: thegr8val
use_case: "Short description of the use case"
model_tested:
- claude-sonnet-4-6
- gpt-4o
language: EN/ES
tags:
- hunting
- ioc
- automation
--- hunting ioc threat-actor malware log-analysis
sigma yara splunk kql automation
api enrichment triage reporting red-team
blue-team osint
TGV-Grimoire es una colección bilingüe de prompts de ciberseguridad para analistas, hunters e ingenieros que aprovechan modelos de IA en sus flujos de trabajo. Cada prompt incluye metadatos completos y está listo para usarse en entornos reales. Los placeholders se indican con [MAYUSCULAS_EN_CORCHETES].
See CONTRIBUTING.md for guidelines, metadata format, and the tag taxonomy.
Found a sensitive file accidentally committed? See SECURITY.md — report privately, not via public issues.
MIT — thegr8val
TGV Toolkit
Made with 🔮 by thegr8val