Start a hunt with a written hypothesis, not a prompt. An AI assistant can then draft queries, suggest data sources and summarize results, while you decide what counts as evidence. The model speeds up the typing. It should not decide whether an intrusion exists.
What a hunt is
Threat hunting is a person looking for adversary activity that existing detections did not flag. It starts from an idea about how an attacker might behave in your environment, then tests that idea against data.
MITRE describes ATT&CK as a common language for adversary behavior, with tactics as the goal (the why) and techniques as the method (the how). That vocabulary gives hypotheses a clear shape.
Write the hypothesis first
A usable hypothesis names a behavior, a place and a data source. For example: an attacker who gained a foothold may use a built-in admin tool to look at accounts on servers, and process creation logs on servers would show it.
Add what normal looks like and what would change your mind. Without that, a model will happily produce a story that fits any result.
Where the assistant helps
Query drafting. Give it your hypothesis, the log schema and the field names, and ask for a candidate query in your search language. Always give real field names, since models invent them.
Source suggestions. Ask what other logs could confirm or refute the idea. You choose.
Summarizing results. Paste a redacted sample of matches and ask for patterns, outliers and questions. See what log data to redact.
Documenting. Have it draft the hunt write-up from your notes for you to correct.
Where you stay in charge
Run queries yourself and read raw events. A model can overlook a rare row or describe an event it did not see. Decide what is suspicious using what you know about the business, such as an admin who legitimately runs these tools.
Treat the data fed to the model as untrusted. Strings in logs may carry instructions, as explained in prompt injection in SOC AI assistants.
Close the loop
Every hunt should end in one of three outputs: a confirmed finding that goes to incident response, a new or improved detection rule, or a note about a data gap you found. Turning a successful hunt into a rule is the lasting value, and rules drafted by a model need the review checklist. For a concrete behavior based hunt, see the living off the land hunting checklist.
A short example flow
- State hypothesis and expected data source.
- Ask the assistant for a query with your schema pasted in.
- Review the query line by line, then run it.
- Inspect raw results, tag benign patterns.
- Record outcome and what you would detect on in future.
Quick check
Can an AI assistant hunt on its own?
It can run searches if you give it tools, but deciding what is suspicious needs context and judgment. Keep a person responsible for conclusions.
What if the hunt finds nothing?
Record it. A negative result with the data you checked is still useful, and a gap in logging is a finding.
Sources
Last reviewed: 19 October 2026.
