Claude.ai is just one door into the same intelligence. there are several others worth knowing.

same Claude underneath. different interfaces built around different types of work. knowing which one to reach for — and when — is what separates occasional use from a genuine workflow upgrade.

the desktop app — three modes, one install

#

the Claude desktop app gives you three distinct ways to work depending on what the task needs.

Chat — same as claude.ai, plus features that come from running natively on your machine.

• quick entry — double tap Option key on Mac, Claude appears as an overlay over whatever you’re working on. ask a question without leaving your current app.
• screenshots and window sharing — capture exactly what’s on your screen instead of describing it
• dictation — talk through a problem instead of typing
• desktop connectors — connect local tools and services

best for — quick questions, drafting, back and forth thinking while you’re deep in other work.

Cowork — agentic. you give it a goal, it does the work.

• works across multiple sources simultaneously using subagents
• reads and writes to folders you share
• scheduled tasks — set recurring work once, Claude handles it automatically every time the app is open
• browser use — navigates websites, pulls data, interacts with pages
• computer use — when no connector exists, Claude navigates your screen directly

best for — research briefs, cross-source analysis, document production, recurring workflows. anything that would take you multiple tabs and significant time.

Code — full development environment inside the desktop app.

• reads and modifies your codebase directly
• visual diffs show exactly what changed
• built-in terminal, git integration
• local or remote via GitHub

three interaction modes:

• Ask — Claude proposes every change, you approve before anything is modified
• Code — applies file changes automatically, checks before running terminal commands
• Plan — outlines full approach before touching anything

best for — building features, debugging, navigating unfamiliar codebases, automating repetitive dev tasks.

Claude Code — for developers

#

Claude Code runs in your terminal, IDE, or browser. direct access to your codebase, no separate interface needed.

when to use it:

• build features by describing what you need in plain english
• debug by pasting error messages — Claude traces the issue across your codebase
• navigate unfamiliar code — ask how different parts connect
• automate repetitive tasks — lint fixes, merge conflicts, release notes

also works inside Slack — tag @Claude on a bug report or feature discussion and it can spin up a Claude Code session using the surrounding thread as context.

Claude in Slack — collaboration in context

#

Claude lives directly in your Slack workspace. chat with it from any channel or mention @Claude in threads.

when to use it:

• summarise lengthy threads without leaving Slack
• draft responses to messages in context
• prepare for meetings by pulling relevant conversations and shared files
• quick answers during live discussions — industry context, technical concepts, company information

SOC relevance — incident channels move fast. Claude in Slack can summarise what’s happened, draft stakeholder updates, and pull context from previous threads while the investigation is still live.

Claude for Excel — spreadsheets without the pain

#

Claude in a sidebar inside Microsoft Excel. reads, analyzes, and modifies your workbook through conversation.

when to use it:

• understand complex multi-tab workbooks and formula dependencies
• debug errors — #REF!, #VALUE!, circular references traced to source
• update assumptions across a model while preserving relationships
• build pivot tables, charts, new templates

useful beyond finance — SOC metrics dashboards, detection coverage tracking, vulnerability data analysis.

Claude for Chrome — browser as workspace

#

Claude as a sidebar in Chrome. observes what you’re working on, takes actions in your browser.

when to use it:

• summarise articles and research papers while browsing
• draft email responses without leaving your inbox
• automate repetitive form filling
• maintain context across tabs during multi-step research

currently in research preview — recommended for low-risk tasks on trusted sites. high-risk actions like purchases require explicit permission. certain site categories blocked by default.

which one when — quick reference

#

and that’s the series.

six posts. from what Claude actually is to where it shows up across your entire workflow. the goal was never to make you an AI expert. just to help you use the tool you already have — properly.

same intelligence. many doors. find the ones that fit how you work.

thanks for reading. genuinely.

what’s the one Claude feature from this series you’re going to try first?

back to series index — still figuring out AI, one post at a time

Claude is only as useful as the context it has. connectors solve that.

without connectors, you’re manually bridging the gap — copy pasting emails, uploading documents, re-explaining your tools every conversation. connectors remove that friction. Claude works directly with your actual data, in the tools you already use.

what connectors are

#

connectors link Claude to external services and applications. instead of starting every conversation from scratch, Claude can read, search, and in some cases act within your connected tools.

powered by the Model Context Protocol (MCP) — think of it as USB-C for AI. a universal standard that lets Claude connect to any application through a single consistent interface. open standard, growing ecosystem, works seamlessly across tools.

two types:

web connectors — cloud services. Google Drive, Slack, Notion, Asana, Gmail, Linear, Stripe, and many more. connect once, Claude references them across conversations.

desktop extensions — local tools through the Claude desktop app. local file access, browser control, native application integration like Figma.

setting up your first connector

#

straightforward process:

• navigate to claude.ai/directory or click + in your chat window
• find the connector you want
• authenticate with your existing credentials
• grant permissions — scoped to what the connector needs
• test with a simple request

permissions are specific and revocable. Claude only sees what you have access to — connecting your work email doesn’t expose your CEO’s inbox. disconnect anytime through Claude settings or the third party service directly.

practical use cases

#

project management — “what are my highest priority tasks due this week?” “create a new task for reviewing this alert.”

communication — “find the email thread about the vendor contract.” “summarise yesterday’s #security channel discussion.”

documentation — “what does our incident response playbook say about ransomware?” “find our escalation matrix.”

SOC specific:

• connect your ticketing system — Claude drafts updates, summaries, closure notes
• connect Slack — pull context from ongoing incident channels without switching tabs
• connect Google Drive — reference playbooks, previous investigation reports, detection documentation mid-conversation

enterprise search — your org’s knowledge base

#

for Team and Enterprise users, Enterprise Search adds a dedicated “Ask Your Org” option to your sidebar. think of it as a pre-built Project for your entire organisation — your company’s tools already connected, knowledge already loaded.

what you can ask:

• “what happened yesterday while i was out?”
• “what’s our process for handling phishing reports?”
• “summarise discussions about the Q4 detection project”
• “who should i talk to about the SIEM migration?”

Claude searches across SharePoint, Slack, Gmail, Google Drive simultaneously and synthesises a unified answer with citations.

setup is two-step — admin connects the org-level tools, individual users authenticate their personal accounts. permissions respected throughout — you only see what you already have access to.

SOC value — new analyst onboarding, shift handovers, finding context across fragmented communication channels. the question you’d normally spend 20 minutes hunting for across three tools — answered in seconds.

security considerations

#

worth being deliberate here:

• only connect tools from trusted sources
• review permissions before granting access
• your conversations remain private — connected data isn’t stored separately
• Claude sees what you see, nothing more

next up — Research mode. the feature that genuinely changes how you investigate things.

which tool in your daily workflow would make the biggest difference if Claude could access it directly?

next up: AI Series #16 — “Research mode — when Claude stops answering and starts investigating” back to series index

everyone has Claude open. almost no one is using it well.

and i was no different. open a tab, ask a question, copy the answer, close the tab. repeat. that’s not working with Claude. that’s just a fancier search engine.

it took me actually sitting down and learning the tool properly to realise how much i was leaving on the table.

why this matters for Security analysts specifically

#

we deal with information overload every single day. 40 open investigations. alert queues that never empty. context switching every 20 minutes. documentation that’s always behind.

Claude doesn’t fix all of that. but used properly — it becomes a serious thinking partner. not a chatbot you ask one-off questions to. an actual collaborator that knows your context, remembers your preferences, and helps you move faster without cutting corners.

that’s the difference between opening Claude and working with Claude.

what this series covers

#

6 posts. built on Anthropic’s Claude 101 course. filtered through a Security analyst’s lens.

• what Claude actually is and how to talk to it properly
• how to organise your work with projects, artifacts, and skills
• connecting Claude to the tools you already use
• research mode — the feature that genuinely changes how you investigate
• Claude beyond the browser — desktop, Slack, Excel, and more

no hype. no “AI will replace you” narratives. just practical, honest notes from someone figuring this out one post at a time.

who this is for

#

Security analysts, security engineers, anyone in tech who has Claude open but isn’t sure they’re getting the most out of it. you don’t need to have read the AI fundamentals series first — but if you haven’t, that’s a good place to start.

see you in post 1.

what’s your current Claude habit — one-off questions or something more structured? curious where most people are starting from.

next up: AI Series #13 — “how to actually talk to Claude — and get something useful back” back to series index

most people treat their first Claude prompt like a google search. that’s where it goes wrong.

google is built for keywords. Claude is built for context. the more you give it, the better it performs. one line in, one line out — you’re not using it, you’re just testing it.

what Claude actually is

#

not a chatbot. not a search engine. a thinking partner.

Claude is built on three principles — helpful, harmless, honest. trained to align with human values, take direction on tone and behavior, and work collaboratively across a wide range of tasks.

what it can do well:

• writing and content creation
• research and analysis
• coding assistance
• complex reasoning and problem solving
• learning new things at your pace

for Security analysts specifically — think investigation summaries, detection rule drafting, alert triage documentation, threat intel synthesis, report writing. all of it.

how to write prompts that actually work

#

three things every good prompt needs:

set the stage — give Claude your role and context. “i’m an L2 security analyst investigating a potential phishing incident” lands very differently than just “help me with phishing.”

define the task — be specific about what you want. write, analyze, summarize, compare — tell Claude exactly what action to take.

specify rules — tone, format, length, style. “keep it under 200 words, bullet points, professional tone” saves you three rounds of back and forth.

putting it together:

“i’m a Security analyst writing an incident summary for a non-technical stakeholder. summarize the following alert details in plain language, under 150 words, no jargon, with a clear recommended action at the end.”

that prompt gets you something usable on the first try.

the iteration mindset

#

first response is a draft. not a final answer.

if it’s too long — “cut this by half, keep the key points.” if the tone is off — “make this more direct, less formal.” if it missed the point — “i was asking about X not Y, let me clarify.”

chaining short follow-up prompts is more effective than writing one massive prompt upfront. think conversation, not command.

common mistakes and quick fixes

#

one framework worth knowing

#

Anthropic references the 4D framework for AI fluency — delegation, description, discernment, diligence.

simplified for daily use:

• delegate — decide what Claude should handle vs. what needs your judgment
• describe — communicate clearly what you need
• discern — evaluate what comes back critically
• diligence — use it responsibly, verify what matters

you’re already doing this intuitively. naming it just makes you more deliberate about it.

next up — projects, artifacts, and skills. how to stop starting from scratch every single conversation.

what’s the most frustrating Claude response you’ve gotten? usually points to a prompt that needed more context.

next up: AI Series #14 — “stop starting from scratch — organising your work in Claude” back to series index

most Claude features save you time. Research mode saves you hours.

not an exaggeration. tasks that would take a morning of tab switching, source hunting, and synthesis — done in 5 to 45 minutes. comprehensive, cited, structured. this is the feature that changes how you approach deep work.

what Research mode actually is

#

not a web search. not a quick lookup. systematic investigation.

when you enable Research mode, Claude operates agentically — conducting multiple searches that build on each other, pursuing leads, filling gaps, exploring different angles of your question automatically. you don’t direct each step. Claude figures out what to look for next based on what it already found.

extended thinking activates automatically alongside Research. Claude plans its approach, breaks complex requests into pieces, then works through them methodically.

end result — a comprehensive report with citations you can verify. not a summary of one source. synthesis across many.

how it works step by step

#

step 1 — planning. extended thinking kicks in. Claude maps what it needs to investigate and how to approach different angles of your question.

step 2 — multiple searches. not one search. many. each building on the last. Claude pursues what’s relevant, ignores what isn’t, fills in gaps as they appear.

step 3 — synthesis. findings from across the web and your connected integrations pulled together into one structured report.

step 4 — citations. every claim linked to its source. verify anything that matters with one click.

when to use Research vs other modes

#

writing effective Research prompts

#

Research can take up to 45 minutes for complex tasks. a better prompt upfront means a better report at the end.

be specific about your goal. instead of “tell me about ransomware trends” try “analyse ransomware trends in 2024-2025 targeting financial services — key threat actors, TTPs, notable incidents, and defensive recommendations.”

specify structure. “organise findings into: threat landscape overview, key actor profiles, common attack vectors, and detection opportunities.”

include constraints. geography, time range, industry focus, depth required. the more Claude knows about what you need, the more focused the output.

ask Claude to help. not sure how to frame it? ask Claude to help you write a better Research prompt before enabling the feature.

SOC relevance — where this actually helps

#

threat intelligence deep dives — “research the current TTP profile of [threat actor], including recent campaigns, tooling, and known detection gaps.”

vendor and tool evaluation — “compare EDR vendors X, Y, Z across detection capability, cloud support, SOC integration, and pricing — structured as an evaluation brief.”

incident context building — “research known exploitation techniques for [CVE], affected versions, public POCs, and available mitigations.”

new attack technique investigation — when a novel technique appears in your environment and you need to understand it fast, Research mode pulls from across the web in one go.

combine with connected integrations for maximum value — “research this threat actor externally, then cross reference with our internal Slack and Drive for any prior mentions or related incidents.”

one useful trick

#

turn off web search and use Research mode with only your connected tools — internal only research. great for “what have we discussed about this threat across Slack and Drive” without pulling external sources.

next up — Claude beyond the browser. desktop app, Code, Slack, Excel, Chrome. where else Claude shows up and when to use each.

what’s a research task you’ve been putting off because it felt too time consuming? that’s your first Research mode candidate.

next up: AI Series #17 — “Claude everywhere — desktop, code, slack, excel, chrome” back to series index

Claude has a memory problem. Projects fix it.

every new chat starts blank. no context. no history. no understanding of who you are or what you’re working on. if you’re re-explaining yourself every single conversation — that’s the problem. Projects, Artifacts, and Skills are how you solve it.

Projects — your persistent workspace

#

a Project is a self-contained workspace with its own memory, knowledge base, and instructions. everything Claude needs to understand your work — already loaded before you type a single word.

three things a Project gives you:

project knowledge — upload documents Claude should always reference. brand guidelines, SOC playbooks, investigation templates, threat intel reports. no more re-uploading the same files every conversation.

project instructions — tell Claude how to behave in this context. tone, format, expertise level, specific requirements. applies to every chat inside the project automatically.

collaboration — on Team and Enterprise plans, share projects with teammates. everyone works from the same context, same instructions, same knowledge base.

practical SOC use cases:

• incident response project with playbooks and templates loaded
• threat intel project with your current campaigns and IOC context
• reporting project with your organisation’s documentation style baked in

Artifacts — outputs you can actually use

#

when Claude creates something substantial — a document, a piece of code, a diagram — it appears as an Artifact. a dedicated window alongside your chat, rendered and ready to use.

artifact types:

• documents — reports, summaries, templates, exportable as Word or PDF
• code — working code in any language, downloadable
• diagrams — flowcharts, sequence diagrams, org charts via Mermaid
• HTML pages — complete web pages, interactive prototypes
• React components — functional UI elements with real logic

for SOC work — investigation summaries as exportable documents, detection logic as code artifacts, incident timelines as diagrams. finished outputs, not just chat responses.

you can share artifacts publicly via link or within your organisation. others can remix them — open in their own Claude to modify and build on.

Skills — reusable workflows

#

Skills are instruction packages that teach Claude how to execute specific tasks consistently. think of them as expertise modules Claude loads when relevant.

two types:

Anthropic built-in Skills — Excel, Word, PowerPoint, PDF creation. already available on paid plans. Claude invokes them automatically when you ask for these file types.

custom Skills — workflows you define. your investigation report format. your weekly threat summary template. your detection rule writing process. create them once, Claude follows them every time.

projects store knowledge. skills define process. the two complement each other — your Project holds the what, your Skill handles the how.

how they work together

#

imagine a weekly threat intel report workflow:

• Project holds your threat intel sources, report templates, and writing style instructions
• Skill encodes the exact process — pull IOCs, summarise TTPs, format by severity, add recommendations
• Artifact delivers the finished report as a downloadable document

one prompt. consistent output. every time.

next up — connecting Claude to the tools you already use. this is where it gets seriously useful.

which part of your current workflow involves the most repetitive context-setting? that’s your first Project candidate.

next up: AI Series #15 — “Claude meets your tools — connectors and enterprise search” back to series index