Specialized LLM tools reduce noise in SOC log investigations

At a glance

What this is: Torq says specialised LLM tools work better than generic prompts for SOC log investigations because they surface the small set of suspicious events hidden inside high-volume Sysmon noise.

Why it matters: For SOC and detection teams, the practical issue is not whether LLMs can read logs, but whether investigation workflows preserve analyst reasoning by filtering noise before context is consumed.

Context

SOC investigations break down when raw telemetry is treated as context rather than something that must be filtered first. In high-volume log environments, a general-purpose LLM can identify patterns, but it still inherits the same analyst problem: too much benign data, too little investigative signal, and attack chains buried inside legitimate activity.

This article sits at the intersection of SOC operations, detection engineering, and AI-assisted investigation. The identity angle is indirect but real, because the investigation workflow depends on the system's ability to distinguish legitimate service and administrative behaviour from suspicious execution chains, privilege changes, and lateral movement indicators.

Key questions

Q: How should SOC teams use LLMs without drowning in log noise?

A: Use LLMs after, not before, the first filtering step. The model should reason over suspicious leads that have already been narrowed by detection heuristics, because raw log dumps waste context on benign activity and hide the attack path. This approach keeps the model focused on explanation, correlation, and reporting rather than brute-force search.

Q: Why do generic prompts fail on endpoint investigations with noisy telemetry?

A: Generic prompts fail because they treat every event as equally available to the model. In practice, legitimate binaries, admin work, and repetitive telemetry create a noise floor that buries encoded commands, unusual process trees, and other attacker clues. When the signal is small and the dataset is large, the failure is architectural, not linguistic.

Q: What are the signs that an AI SOC investigation workflow is not working well?

A: An AI SOC investigation workflow is not working well when teams still need to manually query multiple tools, wait on queued assignments, or accept inconsistent conclusions across analysts. Other warning signs are missed context, slow mean time to acknowledge, and alerts that are reviewed only superficially. A healthy workflow should produce consistent, evidence-backed findings with minimal human friction.

Q: How do specialised detection tools and LLM reasoning complement each other in SOC work?

A: Specialised tools narrow the data to a high-confidence subset, while the LLM connects those findings into a coherent incident narrative. That division of labour matters because tools are better at pattern extraction and the model is better at interpretation, chronology, and report writing. The result is faster triage without sacrificing analyst judgement.

Technical breakdown

Why raw log summarisation misses living-off-the-land activity

Living-off-the-land attacks abuse legitimate tools such as PowerShell, WMI, and signed system binaries, so a filename-first summary often looks harmless. The real signal is in command-line parameters, execution sequence, and surrounding process behaviour, not in the binary name alone. If an LLM is asked to reason over a large, unfiltered event set, it can still miss the one encoded command or suspicious parent-child chain buried inside thousands of normal events. That is why the article argues for specialised hunters that encode detection heuristics before the model reasons.

Practical implication: build detections that surface obfuscation, unusual process lineage, and suspicious execution parameters before handing events to an LLM.

How specialised hunters reduce context-window waste

A specialised hunter is a narrow tool or agent that searches for one attack pattern, such as encoded PowerShell, temporal clustering, external connections, or file persistence. Instead of passing tens of thousands of events to a model, the tool returns only the evidence that matches the heuristic, along with enough metadata for reasoning. This changes the model's job from search to interpretation. In other words, the LLM becomes the analyst's reasoning layer, while the tools do the compression and triage work that make the reasoning possible at scale.

Practical implication: design per-technique filters and enrichment tools so the model consumes actionable leads, not full log dumps.

Why parallel investigation outperforms a single general agent

The article's multi-hunter design mirrors how human SOC teams work: one analyst does not cover malware, lateral movement, and network pivoting equally well. A single agent with many tools spends too much context choosing tools and too little on findings, so the architecture splits the work into focused agents with bounded mandates. That improves coverage, supports parallelism, and makes blind spots easier to spot on a second pass. The important architectural point is that the model can decide how to investigate within a domain, but not whether that domain is inspected at all.

Practical implication: use modular investigation workflows with fixed coverage rather than a router that may skip a relevant attack path.

Threat narrative

Attacker objective: The objective is to execute malware through legitimate-looking processes while evading detection inside noisy endpoint telemetry.

1. Entry occurs through an encoded PowerShell command that looks ordinary if investigators only review the filename column and ignore command-line content.
2. Credentialed or system-level abuse is obscured because legitimate binaries and admin activity blend into the same event stream as the malicious execution chain.
3. The attacker gains persistence or follow-on execution through hidden payload retrieval and related process activity that generic search would leave buried in noise.
4. The impact is an investigation that misses the malicious chain until specialised tooling reconstructs the full attack path from filtered evidence.

Breaches seen in the wild

• Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Specialised investigation tools are now a detection control, not just a workflow preference. When attackers hide inside legitimate binaries and high-volume telemetry, the limiting factor is no longer model language ability but evidence shaping. LLMs can reason over security data, but only if the data has already been narrowed to the suspicious subset. Practitioners should treat log filtering as part of the control stack, not an optional convenience.

Context-window pressure has become a SOC design problem. If analysts and models spend context on 100,000 noisy events, the investigation loses signal before reasoning starts. This is the same governance problem seen in other identity and security domains: the system fails when too much low-value state is allowed to accumulate before decision time. Practitioners should design around information reduction, not assume bigger models solve operational overload.

Detection engineering is shifting from signatures to curated investigative heuristics. The article's most important point is that good security work can be encoded as narrow, testable tools that search for known attacker behaviours such as encoded commands, unusual execution trees, and lateral movement markers. That improves explainability and makes the investigation layer auditable. Practitioners should standardise the heuristics that deserve automation and measure whether each one removes noise without hiding coverage gaps.

Named concept: investigative compression. The article shows that the real value is not broader model memory but compressing raw telemetry into a smaller set of high-confidence leads. That concept matters because it reframes AI in the SOC from summarisation to evidence selection. Practitioners should evaluate AI investigations by how well they compress uncertainty into actionable findings.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Investigative compression: the control problem is no longer how much telemetry the model can ingest, but how much noise the workflow can eliminate before reasoning begins. SOC teams should measure AI-assisted investigations by the quality of the leads they surface, not by the size of the prompt window.

As LLM use spreads into detection and triage, the practical boundary moves from language understanding to evidence selection. Teams that keep feeding raw logs into general prompts will preserve the old bottlenecks, while teams that encode their best heuristics as tools will get a cleaner path from alert to conclusion.

For practitioners

• Encode attack-pattern hunters as first-class detection tools Build narrow tools for encoded PowerShell, unusual parent-child chains, persistence, lateral movement, and external beaconing so the model reasons over curated findings.
• Separate lead selection from analysis Use deterministic filters to surface candidate events before the LLM scores them, reducing the chance that legitimate binaries or noisy summaries hide the real attack path.
• Run parallel investigation workflows Split broad investigations into focused agents or workflows with bounded mandates, then merge findings into one threat-analysis layer for deduplication and final reporting.
• Add a second-pass blind-spot review After initial findings are assembled, re-run targeted searches based on what the first pass uncovered so missed execution chains or persistence clues can surface.

Key takeaways

• LLM-assisted SOC work fails when raw log volume is treated as input for reasoning instead of a problem to be filtered first.
• Specialised hunters improve investigation quality by surfacing suspicious events that generic searches bury inside benign telemetry.
• The architectural win is not a smarter prompt but a workflow that compresses uncertainty into a small set of actionable leads.

Key terms

• Investigation Compression: The reduction of time between alert generation, analyst triage, and containment. In SOC operations, this is a practical measure of whether automation is actually reducing exposure, because attacks that progress quickly can outpace slow human review cycles.
• Living Off The Land Attack: A Living Off The Land Attack is when an attacker uses tools already present in the target environment instead of introducing obvious malware. The attacker relies on legitimate system utilities, scripts, admin features, or cloud services to blend in with normal activity, reduce detection, and move through systems while appearing operationally valid.
• Signal-to-Noise Ratio: The balance between meaningful security events and routine activity in detection tooling. A weak ratio makes analysts spend more time filtering alerts and less time identifying real attacks, which is why architecture quality strongly affects SOC effectiveness.
• Heuristic Analysis: Heuristic analysis is a detection method that looks for suspicious code patterns and behaviors instead of matching known signatures. It is useful for catching new or modified malware, especially when attackers alter existing strains. The trade-off is a higher chance of false positives, so tuning and validation matter.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. For practitioners building identity-aware security programmes, it helps connect access control, lifecycle governance, and operational risk.