Write better questions

Be specific

• Name the system, technology or file you mean: “our nginx reverse proxy” beats “the server”.
• Use real identifiers: CVE, CWE, ATT&CK technique IDs, the exact endpoint or event ID.
• Ask one thing at a time, then follow up to drill in. With an account, Oyster keeps the conversation’s context.
• Say what you want back: a checklist, a detection rule, a remediation with a test, a short explanation.

Pick the right tool

You want	Use
A concept explained	Chat, Quick depth
The mechanism, signals and mitigations	Chat, Technical depth
An answer from your own documents	RAG Analyst, after the files are ready
Facts about a CVE, CWE, CAPEC, ATT&CK technique or D3FEND countermeasure	Security Intel
A plan for an authorized test	Recon or Planner, inside your scope
An investigation with real evidence	SOC Copilot

If the answer is weak

• Add specifics and identifiers; narrow the question.
• For file questions, confirm the file is ready and use RAG Analyst.
• Try a larger model from the footer picker. It is slower but stronger on hard questions.
• Give the answer a 👎 with a correction.
• Start a new chat if the thread has wandered across topics.