Autonomous Threat Hunting with generative AI: from manual hypotheses to intelligent exploration

Traditional threat hunting heavily relies on human expertise to formulate hypotheses, run queries, and analyze large volumes of data. However, this approach faces limitations in terms of scalability, speed, and coverage.

The emergence of generative AI, particularly Large Language Models (LLMs), is redefining this paradigm: we’re now moving toward autonomous threat hunting, where machines not only execute but also formulate, correlate, and refine threat investigations.

Threat hunting with generative AI: a new cognitive approach

Integrating generative AI into the Security Operations Center (SOC) transforms threat hunting from a manual to a collaborative process, where analysts work alongside intelligent agents that understand natural language, contextualize threats, and automatically generate queries across multiple data sources.

Key applications

• Automatic query generation from natural language hypotheses, enabling analysts to express suspicions or lines of inquiry in plain text, which the system then translates into optimized technical queries for various data sources.
• Detection of anomalous patterns by correlating data from network, endpoint, and cloud sources, using contextual analysis and machine learning to identify unusual behaviors, traffic deviations, or atypical access that may signal malicious activity.
• Automated enrichment of findings with Cyber Threat Intelligence (CTI), the MITRE ATT&CK framework, and real-time IoC (Indicators of Compromise) databases, adding valuable context to each detection and improving the accuracy of event correlations.
• Adaptive suggestions to refine the hunting approach based on behavior and topology, analyzing recent system activity and network structure to recommend dynamic adjustments to queries and prioritize higher-risk areas.

Advantages over traditional models

• Acceleration of the hunting cycle from hours to minutes, optimizing detection and correlation through intelligent automation and faster response times.
• Reduced dependency on senior analysts for initial investigations, thanks to automation of repetitive tasks and cognitive assistance that guides junior analysts in interpreting results and formulating more accurate hypotheses.
• Greater coverage of attack scenarios and techniques in multicloud and hybrid environments, by correlating data from diverse infrastructures, services, and providers to offer a unified and comprehensive threat landscape view.
• Continuous system learning based on each hunting session, with models adjusting parameters and expanding their knowledge base from confirmed findings and false positives, progressively improving the accuracy and effectiveness of future hunts.

Challenges in adopting cognitive hunting

• Rigorous validation of the quality and accuracy of auto-generated queries, ensuring the queries created by models are logically consistent, contextually relevant, and technically sound before execution using review and testing mechanisms to avoid inaccurate or irrelevant results.
• Risk of misinterpretations or hallucinated findings from LLMs, which may draw incorrect conclusions due to lack of context or training data bias, requiring constant human oversight to validate results.
• Engineering requirements to integrate multiple heterogeneous data sources (XDR, EDR, NDR, SIEM, etc.), including developing connectors, normalizing data formats, and establishing secure and efficient communication channels to ensure data coherence and interoperability.
• Training analysts in prompt engineering (designing precise prompts to interact with language models), model tuning (customizing AI algorithms for specific contexts), and review of AI-generated findings, to ensure system outputs are relevant, accurate, and aligned with the SOC’s detection goals.

Use case: autonomous cognitive hunting in a financial services company

A banking institution in Latin America, with a 24/7 operational SOC, integrated generative AI into its advanced threat hunting program. The organization used multiple platforms (SIEM, EDR, NDR, and CTI) and had accumulated vast amounts of underutilized data due to limited capacity for deep analysis.

An LLM-based assistant was integrated into the hunting platform, enabling analysts to write hypotheses in natural language such as:

> Search for lateral movement between Windows endpoints with elevated privileges in sensitive network segments over the past 72 hours.

The system would convert this request into multiple specific queries for each platform, correlate real-time results, and suggest new exploration paths based on context (such as anomalous users, changes in network routes, and presence of related MITRE ATT&CK techniques).

Additionally, the system would automatically generate interactive visualizations of suspicious event sequences, along with links to technical articles, IoCs, and supporting evidence from public and private CTI sources.

Results achieved

• Three internal APT simulation campaigns (red team) were detected that had not previously triggered any alerts.
• Average investigation time per hypothesis was reduced from 5 hours to 35 minutes.
• Over 10 junior analysts were trained in autonomous hunting with generative AI, increasing their productivity without requiring prior scripting experience.

Recommendations

• Adopt a hybrid approach where generative AI complements, rather than replaces, expert human judgment, fostering constant collaboration between analysts and intelligent systems to leverage both human intuition and machine analytical speed.
• Define quality and validation frameworks for AI-generated findings, establishing clear metrics for accuracy, reliability, and coherence, along with manual review protocols and periodic audits to ensure automated results meet SOC standards.
• Measure hunting effectiveness based on previously undetected findings, ATT&CK coverage (a framework that classifies attack tactics and techniques), and hypothesis response time reduction, while also tracking operational efficiency, response impact, and SOC maturity growth.
• Integrate this approach with automated containment and response processes (SOAR, Security Orchestration, Automation and Response), closing the loop from hypothesis to action through automated defensive measures, tool coordination, and a significant reduction in detection-to-mitigation time.

Conclusion

Autonomous threat hunting powered by generative AI signals the beginning of a new era in SOC operations. By combining human expertise with the exploratory, correlational, and contextual capabilities of LLMs, the proactive detection of advanced threats is greatly enhanced.

This synergy not only increases efficiency but also democratizes hunting by making advanced capabilities accessible to teams of varying skill levels.

The future of hunting is faster, smarter, more collaborative, and more accessible for SOCs looking to stay ahead of adversaries with agility and precision.

Image: DC Studio, Freepik.