Specialized LLM tools reduce noise in SOC log investigations

At a glance

What this is: Torq argues that LLMs can analyse SOC logs well, but only when the investigation architecture uses specialised tools to filter noise before reasoning begins.

Why it matters: This matters because security teams trying to use AI in detection and response need to separate useful automation from brittle prompt-driven analysis, especially where identity, privilege, and log interpretation intersect.

👉 Read torq's analysis of multi-hunter LLM investigations for SOC log analysis

Context

Large SOC datasets are not hard to search because they lack data. They are hard to search because the evidence is scattered, high-volume, and full of legitimate activity that looks similar to malicious behaviour. In this article, the primary problem is not model intelligence but investigation design, which is why the primary keyword, LLM investigations, should be understood as an architecture question rather than a prompt-engineering one.

For identity and access teams, the interesting overlap is indirect but real: the same evidence handling problems that weaken SOC analysis also weaken visibility into abuse of service accounts, privileged sessions, and compromised credentials. When logs are parsed at scale, the investigation path matters as much as the data source, and that is typical of modern AI-assisted security operations.

Key questions

Q: How should security teams use LLMs in SOC investigations without losing critical evidence?

A: Use LLMs after signal extraction, not before it. The most reliable pattern is to let specialised tools or hunters reduce raw telemetry into scoped findings, then ask the model to reason over those findings. That preserves analyst-style investigation while limiting the noise, token waste, and context bias that cause misses in dense logs.

Q: Why do broad LLM prompts fail in endpoint log analysis?

A: Broad prompts fail because they ask the model to identify signal inside the same high-volume data that already overwhelms human analysts. Legitimate binaries, routine admin activity, and malicious commands can look similar in summaries. Without a filter layer, the model wastes context on noise and may miss the attack path entirely.

Q: What breaks when SOC automation relies on one general-purpose agent?

A: One general-purpose agent has to choose tools, decide priorities, and reason about multiple attack paths at once. That creates latency, poor selection decisions, and weaker coverage. A specialist architecture works better because each agent focuses on a narrow technique set and the final layer merges their findings into one case.

Q: How do you know if AI-assisted hunting is actually improving security?

A: Look for shorter time to validated evidence, more repeatable hunt logic, and detections that are promoted from successful investigations. If the platform only creates faster reports, it is improving workflow, not security. Real improvement shows up when the team can confirm suspicious activity, preserve the chain of evidence, and rerun the same logic later.

Technical breakdown

Why raw Sysmon data breaks LLM investigations

Sysmon produces dense endpoint telemetry, but dense telemetry is not the same as investigable evidence. A large language model can summarise and correlate, yet it still inherits the constraints of its context window, including primacy and recency bias. If the model spends tokens reading filenames and generic event summaries, it can miss the malicious command buried inside normal process activity. The failure is not that the model cannot reason. It is that the data pipeline asks it to reason before the signal has been isolated.

Practical implication: reduce the amount of raw log material an LLM must inspect before it can make a decision.

Specialised hunters turn heuristic detection into scoped evidence

The article’s core architecture uses dedicated hunters that each encode a detection heuristic, such as encoded PowerShell, suspicious process trees, rare processes, or lateral movement indicators. This is closer to analyst workflow than to generic search. Each hunter acts as a targeted filter, converting thousands of events into a small set of high-value leads. The model then reasons over findings rather than trying to discover them from scratch. That shift is especially useful where attacker tradecraft hides inside legitimate tooling, because the heuristic is what exposes the anomaly.

Practical implication: encode analyst heuristics into tools so the model receives findings, not event floods.

Why parallel multi-agent analysis outperforms a single broad agent

A single agent with many tools spends effort choosing how to investigate, which introduces latency and selection risk. The article argues for multiple focused agents running in parallel, each confident in a narrow domain, with a final correlation step that merges and deduplicates findings. This matters because security investigations are rarely linear. One lead can legitimately reopen another line of inquiry, so the system needs both focus and escape hatches. The architecture mirrors how human SOC teams work: specialists investigate in parallel, then a coordinator assembles the case.

Practical implication: design AI-assisted investigations as parallel specialist workflows with a consolidation layer, not one generalist chain.

Threat narrative

Attacker objective: The attacker aims to blend malicious activity into trusted Windows process telemetry so the SOC misses the attack until it has already progressed.

1. Entry begins when malicious activity is hidden inside legitimate endpoint telemetry, such as encoded PowerShell embedded in otherwise normal Sysmon events.
2. Escalation occurs when generic search and filename-based triage bury the malicious command inside high-volume noise, delaying or preventing recognition of the attack pattern.
3. Impact is missed or delayed detection of living-off-the-land activity, which reduces the organisation's ability to reconstruct the full incident chain and respond before the attacker advances.

NHI Mgmt Group analysis

Specialised evidence filtering is becoming the real control point in AI-assisted SOC work. The article shows that raw model capability is not the limiting factor when telemetry is noisy. What matters is whether the investigation pipeline surfaces a small, meaningful evidence set before reasoning begins. For security teams, this means the control problem is shifting from query quality to signal selection quality.

LLM investigations expose a new form of detection-response latency. The delay is not just analyst time, but the time the system wastes on irrelevant context. That creates a practical gap between data collection and usable insight, especially in environments with dense endpoint logs. Teams that keep relying on broad prompts will keep paying a token tax for weak triage.

Multi-agent SOC design is a governance problem as much as an engineering one. When each hunter owns a narrow domain, organisations need clear responsibility for tuning, validation, and escalation logic. That aligns naturally with NIST-CSF and MITRE-ATT&CK style mapping, because the issue is not only whether a technique is detected but whether the workflow can defend its coverage choices.

LLM-driven detection should be measured against investigator fidelity, not model fluency. A clean incident report is not enough if the underlying process missed lateral movement, privilege escalation, or encoded command execution. The useful question is whether the architecture preserves the analyst's ability to see what mattered first. Practitioner implication: treat the model as a reasoning layer on top of structured hunting, not a replacement for it.

Identity signals are a secondary beneficiary of this architecture, not the article's core theme. The same tool-based approach could improve how teams inspect privileged session abuse, service account misuse, or suspicious authentication chains. That intersection matters because identity abuse often hides in the same noisy logs as endpoint tradecraft. Practitioner implication: if your SOC cannot isolate identity-related evidence quickly, your IAM and detection programmes will both underperform.

What this signals

Detection architecture is becoming a governance issue for identity-heavy SOCs. If a team cannot isolate suspicious process, script, or credential activity quickly, identity abuse will be detected late even when the telemetry exists. The practical response is to connect AI-assisted hunting to identity-aware control points such as privileged access, service account activity, and delegated access paths, then validate those paths against the MITRE ATLAS adversarial AI threat matrix.

Context efficiency will shape whether AI improves security operations or just increases reporting volume. Teams that keep scaling prompts without restructuring evidence flow will trade analyst time for token spend. That is where a named concept such as detection-response latency becomes useful, because it captures the gap between collecting logs and producing a defensible incident narrative. If the gap persists, the SOC may look faster while actually seeing less.

The article also signals a broader move toward specialist AI workflows rather than single-agent generalism. That matters for IAM and NHI teams because the same pattern can be applied to suspicious authentication chains, privilege surges, and service account misuse, provided the investigation logic is explicit and testable.

For practitioners

• Define high-signal investigation heuristics Translate your most common SOC use cases into explicit filters for encoded commands, unusual parent-child process chains, external connections, and rare binaries. Start with the few patterns that consume the most analyst time, then test whether each filter returns actionable evidence instead of generic noise.
• Use specialist agents for distinct detection paths Split broad investigations into narrow workflows such as script abuse, temporal clustering, process-tree analysis, and lateral movement hunting. Give each workflow a bounded toolset so it can operate quickly without spending tokens deciding how to investigate.
• Measure detection quality by missed techniques Track which MITRE ATT&CK techniques a workflow consistently fails to surface, not just how many alerts it produces. Compare the model's final report against the underlying event set to see whether noise reduction is improving fidelity or simply hiding blind spots.
• Create an escalation path for out-of-pattern findings Allow hunters to break out of their checklist when a suspicious URL, file hash, or process chain appears across multiple event types. That escalation path should support deeper search across all columns so one strong clue can reshape the investigation.

Key takeaways

• The article argues that the bottleneck in AI-assisted SOC work is evidence selection, not model intelligence.
• Specialised hunters can surface more relevant techniques and IOCs because they filter noise before the model reasons over it.
• For practitioners, the priority is to measure investigation fidelity, coverage, and escalation quality, not just report speed.

Key terms

• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.
• Detection-Response Latency: The elapsed time between identifying a security issue and executing a bounded, auditable fix. In data security programmes, long latency means exposure persists after discovery, which undermines the value of detection and weakens compliance evidence.
• Specialist hunting workflow: A specialist hunting workflow is a narrowly scoped investigation path designed to detect one class of behaviour, such as encoded scripts, lateral movement, or process anomalies. It improves signal quality by turning analyst heuristics into explicit filters before an LLM reasons over the result.
• Escape hatch: An escape hatch is a controlled way for an investigation agent to leave its scripted path when a strong clue appears. It lets the workflow search across broader data, enrich findings, and pivot without waiting for a generic router to approve the move.

What's in the full article

Torq's full article covers the engineering detail this post intentionally leaves for the source:

• A concrete breakdown of the multi-hunter architecture and how each specialist workflow is scoped.
• Examples of the custom detection tools used for encoded PowerShell, lateral movement, and temporal clustering.
• The token and call-count comparison between the baseline approach and the multi-hunter design.
• Implementation notes on how the system handles escape hatches when a hunter finds a high-value clue.

👉 Torq's full post covers the attack example, tool design, and performance comparison in more depth.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle control. It is designed for practitioners who need to connect identity governance to the broader security programmes their environment depends on.