AI threat hunting is threat hunting in which AI agents do much of the hands-on work. They read a threat report or hypothesis, decide which behaviors and indicators to look for, write the searches in each tool's query language, run them, and report what they found. A human hunter still chooses what to hunt for, reviews the results, and decides what to do about them.
How AI Threat Hunting Works
A typical AI-driven hunt follows the same steps a human hunter would:
- Start from intelligence or a hypothesis: a new advisory, a campaign report, or a question such as "has anyone dumped LSASS on our servers this month?"
- Pick the data: work out which logs would show the behavior (process creation, authentication, DNS, cloud audit logs) and which tools hold them.
- Write the searches: translate the behavior into SPL for Splunk, KQL for Microsoft Sentinel or Defender, CQL for CrowdStrike, and so on.
- Run and read: execute the searches, look at the matches, and follow up on anything suspicious with more queries.
- Report: summarize matches, benign explanations, and gaps in coverage.
The agent's value comes from speed and breadth. It can cover a full report's worth of techniques across several tools in the time a person might spend on one.
AI Threat Hunting vs Machine Learning Anomaly Detection
Earlier "AI hunting" usually meant machine learning models that flag statistical outliers, such as a user logging in at an unusual hour. Those models are useful, but they produce alerts, not investigations. AI threat hunting with agents is closer to what a human hunter does: start from a question, search for specific behaviors, and reason about what the results mean. The two can work together, with anomalies feeding hypotheses for agents to investigate.
Why "Not Seen" Needs Checking
The hardest part of any hunt is the negative result. A search that returns nothing means the activity is absent only if the tool collected the right logs, the needed fields were populated, and retention covered the whole time window. A good AI hunting agent checks these before saying "not seen," and says "could not check" when the data is missing. Without that, AI hunting can produce confident answers built on empty data.
Example
A report describes attackers using a renamed copy of rclone.exe to send files to cloud storage. The hunting agent searches process events for the tool's typical command-line arguments regardless of file name, plus DNS and proxy logs for the storage domains named in the report. Splunk and Defender return no matches over 30 days. The CrowdStrike tenant covering a subset of Linux servers does not record full command lines for that process type, so the agent marks those servers as "could not check" and suggests a narrower hunt on network logs instead.
FourCore HUNT runs hunts like this inside existing SIEM and EDR tools, with agents writing the searches and checking logs, fields and retention before calling anything "not seen."
Frequently Asked Questions
Can AI do threat hunting on its own?
AI agents can run most of the mechanical steps of a hunt, from writing searches to summarizing matches. A person still sets the priorities, reviews findings, and decides on response, because context about the business and its systems matters.
What data does AI threat hunting need?
It needs the same telemetry a human hunter uses: endpoint process data, authentication logs, network and DNS logs, and cloud audit logs. It also needs to know how long each tool keeps data, so it can judge whether a search covered the full window.
Does AI threat hunting require moving logs to a new platform?
No. Agents can query the tools you already run in their own query languages, which avoids copying data into another store.