# Write better questions

> Get sharper answers from Oyster — be specific, use real identifiers, ask one thing at a time and pick the right tool and depth.

Source: https://documentation.redorca.ai/guides/better-questions/
Last updated: 2026-11-01

## Be specific

- **Name the system, technology or file** you mean: "our nginx reverse proxy" beats "the server".
- **Use real identifiers:** CVE, CWE, ATT&CK technique IDs, the exact endpoint or event ID.
- **Ask one thing at a time,** then follow up to drill in. With an account, Oyster keeps the conversation's context.
- **Say what you want back:** a checklist, a detection rule, a remediation with a test, a short explanation.

## Pick the right tool

| You want | Use |
|---|---|
| A concept explained | Chat, **Quick** depth |
| The mechanism, signals and mitigations | Chat, **Technical** depth |
| An answer from your own documents | **RAG Analyst**, after the files are **ready** |
| Facts about a CVE, CWE, CAPEC, ATT&CK technique or D3FEND countermeasure | **Security Intel** |
| A plan for an authorized test | **Recon** or **Planner**, inside your [scope](https://documentation.redorca.ai/guides/red-team/scope/) |
| An investigation with real evidence | **SOC Copilot** |

## If the answer is weak

- Add specifics and identifiers; narrow the question.
- For file questions, confirm the file is **ready** and use RAG Analyst.
- Try a larger model from the footer picker. It is slower but stronger on hard questions.
- Give the answer a 👎 with a correction.
- Start a new chat if the thread has wandered across topics.