Alert triage decides what an existing alert means. Detection engineering builds and tunes the rules that create alerts. Threat hunting looks for activity those rules missed. They feed each other, and AI help is useful in different ways in each, so it pays to keep them separate.
Alert triage
Question: Is this alert real, and how urgent is it?
Output: A decision and a ticket: close, escalate or investigate further.
Pace: Continuous, driven by the queue.
AI fit: Good for summaries, enrichment suggestions and grouping related alerts. Risky if the model closes alerts alone. See can an LLM triage security alerts.
Detection engineering
Question: What should we alert on, and how do we keep the alerts accurate?
Output: Rules, tests, documentation and tuning changes. Rules might be written in a shared format like Sigma, which describes activity to find in log data.
Pace: Project work with a review process.
AI fit: Models can draft rules and test cases quickly. The risk is rules that parse but do not match real field names or log sources, so every draft needs the review checklist. For managing rules as code, see a detection as code pipeline for Sigma rules.
Threat hunting
Question: What is happening that our detections do not see?
Output: Findings for incident response, new detection ideas and notes on data gaps.
Pace: Scheduled, hypothesis driven.
AI fit: Good for query drafting and summarizing. Judgment about what is suspicious stays with the hunter. See hypothesis driven threat hunting with an AI assistant.
How they connect
- Triage shows which rules are noisy. That feeds detection engineering.
- Hunting finds gaps. That becomes new detections.
- Detection engineering reduces the load on triage by removing noise.
- Triage outcomes show hunters what real attacks look like in your environment.
If one of these is missing, the loop breaks. A team that only triages never improves its rules. A team that only writes rules never learns which ones help.
Skills and staffing
Triage needs speed and judgment under time pressure. Detection engineering needs data knowledge, writing precision and testing discipline. Hunting needs curiosity, knowledge of attacker behavior and comfort with large data.
On a small team, one person may do all three on different days. Name the mode you are in, because the right questions differ. If you are not sure what a SOC does day to day, read what does a SOC do day to day.
Quick check
Is hunting just manual triage?
No. Triage starts from an alert. Hunting starts from a hypothesis and looks where no alert fired.
Where should a small team add AI first?
Where mistakes are cheapest to catch: alert summaries for analysts to read, or draft rules that go through review and testing.
Sources
Last reviewed: 19 October 2026.
