Notifications
Clear all
Topic starter
02/08/2026 12:12 pm
TL;DR: LLMs are strong at log analysis but fail when investigators spend context on raw event noise, so specialized hunters and tool-based filtering can surface actionable evidence faster, according to torq. The key shift is architectural: security teams need constrained workflows that preserve analyst reasoning, not larger context windows alone.
NHIMG editorial — based on content published by torq: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
Questions worth separating out
Q: How should security teams use LLMs in SOC investigations without losing critical evidence?
A: Use LLMs after signal extraction, not before it.
Q: Why do broad LLM prompts fail in endpoint log analysis?
A: Broad prompts fail because they ask the model to identify signal inside the same high-volume data that already overwhelms human analysts.
Q: What breaks when SOC automation relies on one general-purpose agent?
A: One general-purpose agent has to choose tools, decide priorities, and reason about multiple attack paths at once.
Practitioner guidance
- Define high-signal investigation heuristics Translate your most common SOC use cases into explicit filters for encoded commands, unusual parent-child process chains, external connections, and rare binaries.
- Use specialist agents for distinct detection paths Split broad investigations into narrow workflows such as script abuse, temporal clustering, process-tree analysis, and lateral movement hunting.
- Measure detection quality by missed techniques Track which MITRE ATT&CK techniques a workflow consistently fails to surface, not just how many alerts it produces.
What's in the full article
Torq's full article covers the engineering detail this post intentionally leaves for the source:
- A concrete breakdown of the multi-hunter architecture and how each specialist workflow is scoped.
- Examples of the custom detection tools used for encoded PowerShell, lateral movement, and temporal clustering.
- The token and call-count comparison between the baseline approach and the multi-hunter design.
- Implementation notes on how the system handles escape hatches when a hunter finds a high-value clue.
👉 Read torq's analysis of multi-hunter LLM investigations for SOC log analysis →
LLM-driven SOC investigations: where do specialized tools help most?
Explore further
02/08/2026 1:15 pm
Specialised evidence filtering is becoming the real control point in AI-assisted SOC work. The article shows that raw model capability is not the limiting factor when telemetry is noisy. What matters is whether the investigation pipeline surfaces a small, meaningful evidence set before reasoning begins. For security teams, this means the control problem is shifting from query quality to signal selection quality.
A question worth separating out:
Q: How do you know if AI-assisted hunting is actually improving security?
A: Look for shorter time to validated evidence, more repeatable hunt logic, and detections that are promoted from successful investigations. If the platform only creates faster reports, it is improving workflow, not security. Real improvement shows up when the team can confirm suspicious activity, preserve the chain of evidence, and rerun the same logic later.
👉 Read our full editorial: Specialized LLM tools reduce noise in SOC log investigations
