Analyst Notes
The review reads your thought process, not just your choice. Use a simple, clear structure.
Write in this order:
- What is happening?
- What evidence did you rely on?
- Why did you choose this decision?
- What is the next step?
- What will you escalate or follow up on?
Example of Strong Notes
There are indicators worth investigating, but not enough evidence of a confirmed compromise. I recommend contacting the user to confirm the activity and reviewing active sessions before taking containment action.
Weak vs. Strong Notes
Same situation, two different ways of writing — see the difference.
Weak Example
Closed the alert because it seemed unimportant.
Better Example
I reviewed the login logs and noticed an attempt from an unusual location with a short time gap from the last known session. There is not enough evidence for a confirmed breach, but it's recommended to verify with the user and confirm if travel or VPN use was legitimate.
The strong example connects to specific evidence, states the limits of its knowledge, and suggests a specific verification step instead of a final decision.