In the previous part of this series, we explored the threat hunting process, from planning and executing hunts to measuring their success.
In this part, we'll explore how LLMs are transforming threat hunting, where they fit and the value they bring to security teams.
SOC teams are equipped with powerful tools and capabilities, from SIEM and EDR to anomaly detection and threat intelligence. These technologies provide broad visibility into enterprise environments and help detect suspicious activity. However, threat hunting is largely driven by the analyst.
Threat hunters develop hypotheses, query security data, correlate evidence from multiple sources, validate their assumptions, and document the results. These activities are fundamental, but they are often repetitive, time-consuming and require a high level of experience.
As organizations continue to grow, so does the volume and complexity of security data. Threat hunters must work across endpoints, cloud environments, networks, and other data sources, making investigations increasingly complex. The challenge is no longer collecting data but making sense of it quickly enough to identify real threats.
This growing complexity has created a need for tools that can help threat hunters move faster without replacing their expertise. That's where Large Language Models (LLMs) begin to fit into the threat hunting process
LLMs are designed to process and generate human language, which makes them well suited for tasks that involve interpreting information, answering questions, and generating content. In threat hunting, they act as intelligent assistants that complement existing security tools, enabling analysts to interact with data more efficiently and accelerate different stages of the process.
Throughout the threat hunting lifecycle, analysts can be assisted in several ways, including:
Coming up with good hunting ideas often requires experience, knowledge of attacker behavior, and an understanding of current threats.
An LLM can turn threat intelligence, attacker techniques, and observed behaviors into potential hunting ideas
Instead of manually translating hunting ideas into query languages, hunters can describe what they are looking for in natural language and use an LLM to generate queries such as KQL, ES|QL, Splunk SPL, and other languages.
For example, an analyst investigating PowerShell abuse could ask:
The model can translate that request into an ES|QL query, giving the analyst a starting point that can then be refined.
In practice, experienced hunters spend a surprising amount of time refining queries. The first version rarely returns exactly what they're looking for.Using LLMs can speed up this iterative process by suggesting improvements, optimizing query structure, and explaining how existing queries work
Complex logs become easier to interpret because the model highlights unusual events ,explains what happened and points analysts toward areas that require further investigation.
Threat intelligence reports can be processed much faster by easily extracting indicators of compromise (IOCs), highlighting key findings, mapping attacker behaviors to the MITRE ATT&CK framework, and identifying techniques that can be used to guide hunts.
During investigations, analysts often need to piece together evidence from different sources. An LLM assists by connecting related events, analyzing security data, and providing a more complete picture.
Once a hunt is complete, analysts often have to document what they searched for, what they found, and why they reached their conclusion. That work often takes longer than expected.
Preparing hunt reports becomes much simpler because the model can create a draft report, making it easier to record what was found.
The use of LLMs in threat hunting is expanding beyond assistance to AI agents that can perform more complex tasks.
LLMs can be viewed as the “brain” behind these agents because they can process information, reason over data, and generate responses based on the information they receive.
Unlike traditional LLM usage, where analysts interact with the model through prompts and receive responses, AI agents can take a more active role by planning tasks, using tools, and executing multi-step workflows based on a specific objective with minimal human intervention.
In the context of threat hunting, AI agents can automate repetitive tasks such as running queries, gathering relevant data, analyzing results, and summarizing findings.
Despite their advantages, LLMs also introduce new challenges that security teams must consider. Their effectiveness depends not only on the capabilities of the model but also on how it is implemented, integrated into the existing workflows, and used by the analysts.
The biggest limitation of LLMs is that they can sound convincing even when they're wrong.
They can sometimes produce incorrect or misleading responses, a problem known as hallucination. This can lead to inaccurate queries, missed threats, or false conclusions if the output is accepted without verification. Analysts should therefore treat LLM generated content as a starting point and validate it before using it.
To reduce the risk of inaccurate responses, organizations can improve how information is accessed and used. One common approach is Retrieval Augmented Generation (RAG) which allows the model to retrieve information from trusted sources such as internal security documentation, threat intelligence, or security knowledge bases before generating a response. Another approach is to fine-tune the model on cybersecurity specific data which allows it to better understand security concepts, terminology, and workflows.
These techniques assist in producing responses that are more accurate and relevant, but they do not eliminate the need for human validation.
Data privacy and security are also key considerations. Security teams should be careful about the data they share with a model, especially when it includes sensitive logs or internal security information.
To reduce the risk of exposing sensitive data, organizations can consider using locally deployed models. This keeps sensitive information inside the organization's environment, giving control over data privacy, access, and compliance.
Despite the advances in LLM capabilities, human judgment remains critical.
While analysis can be completed more quickly and repetitive tasks can be reduced, the final decision should always remain with the analyst. Human expertise is still essential for validating the results and making the final decisions.
“The goal is not to replace analysts or fully automate threat hunting, but to use these models as a tool that helps them improve their efficiency and focus on more complex security tasks where their expertise matters most”.
Threat hunting has always depended on the analyst's ability to ask the right questions and connect related evidence. LLMs don't change that responsibility, but they reduce much of the manual work surrounding it.
