Treat an LLM-drafted log query as untested code. Run it with a read-only account, bound it by time window and result count, read it before you execute it and check a few raw results. Most problems are cost, wrong field names and quietly wrong logic, not dramatic failures.
What goes wrong
Invented fields. The query uses a field your logs do not have, so it returns nothing and looks like a clean result. This is the worst case, since empty looks reassuring.
Wrong logic. An OR where you wanted an AND returns far too much. A missing exclusion buries you in noise.
Cost. A search over all indexes for a long period can be slow and costly on some platforms.
Writes. Some platforms have commands that modify or delete data. A model should not be able to run those, whatever it suggests.
Before running
- Give it your schema. Paste real field names and an example event into the prompt. Models do much better with that.
- Read the query. Say in plain English what it matches. If you cannot, do not run it.
- Check for write or delete commands. Reject any.
- Bound it. Set a short time range first, and a result limit.
- Pick the narrowest indexes. Name them.
Make read-only real
Do not rely on a prompt that says to avoid changes. Use an account that only has search permission, so the platform enforces it. OWASP calls this complete mediation for excessive agency: authorization lives in the downstream system, not in the model's judgment. It also advises minimal permissions and granular tools over open ended ones. If an assistant runs searches for you, give it one narrow search function with limits built in, not general access to the platform API. The checklist in excessive agency permissions goes further.
Verify the result
Test the query on a case where you know the answer. Search for an event you caused, such as a test login, and confirm it appears. If a known event does not appear, the query or the log source is wrong. Then read several raw rows, not just counts.
Compare the count with a simpler hand written query as a sanity check.
Save what works
Once reviewed, store the query in version control with a note on what it does, the schema it assumes and who reviewed it. Good queries often become detection rules; follow the review steps in reviewing an LLM written Sigma rule.
Watch the data you send
Pasting sample events into a prompt shares log content. Apply the redaction advice in what log data to redact.
Quick check
Why is an empty result dangerous?
It looks like nothing was found, but it may mean the query is wrong or the data is missing. Always test with an event you know exists.
Is a prompt saying read only enough?
No. Enforce read-only access in the platform with the account permissions.
Sources
Last reviewed: 19 October 2026.
