Step 1 – Start With a Hunting Hypothesis

Instead of asking AI to “find attacks,” describe the behavior you’re looking for.

For example:

I want to investigate unusual PowerShell activity
on Windows endpoints.

I'm specifically interested in:
- PowerShell launched by unusual parent processes
- Encoded command-line arguments
- PowerShell connecting to external hosts

Step 2 – Generate a Query

Now ask AI to translate the hypothesis into your SIEM’s query language.

Create a KQL threat-hunting query for these behaviors.

Use standard Microsoft Defender/Sentinel fields where possible.

Explain:
- What each condition does
- Which fields are important
- What could cause false positives

This is for an authorized security lab.

You can do the same for Splunk:

Convert the same hunting logic into Splunk SPL.

Explain the equivalent fields and any assumptions.

Step 3 – Test the Query

Never assume a generated query is correct.

Run it against known test data and check:

Expected event → Query finds it
Normal event   → Query doesn't incorrectly match

If nothing appears, give AI an example of your actual log structure and ask it to adjust the query.

Step 4 – Improve the Detection

Once the query works, ask:

Review this hunting query.

Suggest ways to:
- reduce false positives
- improve performance
- make the behavior more specific

Don't change the original intent.

The Workflow

Hunting Hypothesis
       ↓
      AI
       ↓
SIEM Query
       ↓
Test
       ↓
Tune
       ↓
Threat Hunting

AI is particularly useful here because you can focus on what behavior you want to investigate, while it helps translate that idea into the syntax required by your SIEM.