Topic starter
02/08/2026 12:12 pm
TL;DR: LLMs are strong at log analysis but fail when investigators spend context on raw event noise, so specialized hunters and tool-based filtering can surface actionable evidence faster, according to torq. The key shift is architectural: security teams need constrained workflows that preserve analyst reasoning, not larger context windows alone.
Editorial analysis by NHI Mgmt Group, based on content published by torq: “Stop Feeding Logs to LLMs: A Multi-Agent Approach to Security Investigation”.
Key questions
Q: How should SOC teams use LLMs without drowning in log noise?
A: Use LLMs after, not before, the first filtering step.
Q: Why do generic prompts fail on endpoint investigations with noisy telemetry?
A: Generic prompts fail because they treat every event as equally available to the model.
Q: What are the signs that an AI SOC investigation workflow is not working well?
A: An AI SOC investigation workflow is not working well when teams still need to manually query multiple tools, wait on queued assignments, or accept inconsistent conclusions across analysts.
Practitioner guidance
- Encode attack-pattern hunters as first-class detection tools Build narrow tools for encoded PowerShell, unusual parent-child chains, persistence, lateral movement, and external beaconing so the model reasons over curated findings.
- Separate lead selection from analysis Use deterministic filters to surface candidate events before the LLM scores them, reducing the chance that legitimate binaries or noisy summaries hide the real attack path.
- Run parallel investigation workflows Split broad investigations into focused agents or workflows with bounded mandates, then merge findings into one threat-analysis layer for deduplication and final reporting.
Bottom line: LLM-assisted SOC work fails when raw log volume is treated as input for reasoning instead of a problem to be filtered first.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:15 pm
Specialised investigation tools are now a detection control, not just a workflow preference. When attackers hide inside legitimate binaries and high-volume telemetry, the limiting factor is no longer model language ability but evidence shaping. LLMs can reason over security data, but only if the data has already been narrowed to the suspicious subset. Practitioners should treat log filtering as part of the control stack, not an optional convenience.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How do specialised detection tools and LLM reasoning complement each other in SOC work?
A: Specialised tools narrow the data to a high-confidence subset, while the LLM connects those findings into a coherent incident narrative. That division of labour matters because tools are better at pattern extraction and the model is better at interpretation, chronology, and report writing. The result is faster triage without sacrificing analyst judgement.
👉 Read our full editorial: Specialized LLM tools reduce noise in SOC log investigations