THE AGENTIC THREAT HUNTER

Summary from the TLDR InfoSec newsletter

Threat hunting follows the scientific method in which analysts observe logs, develop hypotheses, test the hypotheses, and iterate, but this model is crumbling under the vast amount of logs present in modern environments. To augment security teams, AI agents can be used to monitor vast amounts of logs and develop initial hypotheses to augment security teams. SOCs can begin leveraging agentic AI by developing explicit hypotheses, pairing with AI for investigations, centralizing data in a SIEM or data lake, setting appropriate guardrails for the agents, and then automating repetitive tasks.