An Intellyx BrainBlog for Dropzone AI, by Jason English
Every threat hunt is a foot race against attackers, who all too often are already taking advantage of vulnerabilities with automated agents, while cybersecurity teams miss the starting gun.
By the time a novel exploit is discovered by the cyber community, reported as a CVE, or disclosed to technology vendors and open source foundations to issue patches and mitigation procedures, there’s a good chance attackers are using agentic AI and readily available automation to continuously look for that new hole in your organization’s armor.
Threat hunting activities should fill in this gap and find exploits specific to the organization’s environment. But given the queue of active issues and incidents the SOC analyst needs to resolve, it is the part of the job that never quite fits in their week: forming a hypothesis, writing the queries, chasing results across four consoles, then writing up whatever they did or didn't find for each investigation.
Since the cost of an attack is close to zero, attackers can practically run an infinite number of agent attacks, rifling through thousands of different parameters, from prompt injections, to man-in-the-middle interception attempts, to social engineering attacks and even the hijacking of your own AI-enabled tooling.
But as a defender, you only need to make one mistake, at one point in time, to possibly lose the keys to the kingdom. Skilled security pros are in short supply. And even your most experienced analyst armed with the ultimate AI SOC solution could never prepare for all of the possible contingencies, much less have time to run so many hunts.
What if you could give your team a head start, and eliminate the fruitless investigations?
Deterministic tools can lead to dead ends
The familiar process of security engineers responding to queues of alerts from SIEM and EDR with a mixed bag of threat hunting tools and playbooks never really went away. It’s still happening in most SOCs.
Unfortunately, human teams just don’t have the time or resources to use existing deterministic tools at the speed required to investigate, discover, and repel AI-based attacks, which can find non-deterministic ways to avoid detection and get around defenses.
Even a well-conceived hunt has to compete with the queue. A single hunt can take a specialist 10 to 20 hours, which is why hunting tends to happen rarely, reactively, or not at all. And plenty of the hunts that do run end without a clean answer: no confirmation it was a false positive, and no confirmation something was missed. That isn't a judgment problem. The hunt just ran out of hours before it ran out of leads.
It would be better to let agents take some of this frustrating investigative work out of the queue, so the team can get findings that separate the merely suspicious from the truly malicious.
Too much detection data, not enough context
An analyst can look at a stream of notifications emanating from Microsoft Defender or CrowdStrike, and see thousands of alerts a day.
Because of this, companies deploy more detection platforms that are focused on specific parts of the stack, from the network layer, to Linux kernel traces, to API traffic or now, MCP servers. Each platform may have its strengths for handling certain types of telemetry data and eliminate false positives for their own areas of the stack, but they can all generate even more alerts.
A lot of the alerts are benign: system-level notifications, flapping errors that don’t affect anything, or a user that forgot a password. Even a service interruption may not be a DDoS attack; it could be a slow cloud region. Failing transactions could be an agent somewhere that is not structuring its API requests according to specification.
Whatever the case, alerts that are only relevant to development and operations teams are blind alleys for SecOps investigations, if there’s no malicious intent behind them.
All of this telemetry has to go somewhere, so there’s a multi-billion-dollar market just for storing, moving, managing, and filtering security data. Rather than increase the footprint of this data estate with more meaningless alerts, agents can help us look at the signal data at its source, and better interpret which alerts might represent threats worth investigating.
Agents need to think like analysts
A good analyst knows how to think like an attacker. A good threat hunting agent should think like OSCAR.
No, OSCAR is not some smart guy. Nor is it another tool. OSCAR is a five-phase methodology (Obtain Information, Strategize, Collect Evidence, Analyze, Report) for investigating security alerts. It was introduced to the cyber community in 2012 to give human analysts an “order of operations” for more predictable results.
Dropzone AI’s Threat Hunter is trained to follow OSCAR as well, so the agent keeps seeking out information and working around gaps to solidify its determinations rather than stopping at the first inconclusive result. Each hunt pack bundles five to ten hunts that run together, so each hunt that would take a specialist 10 to 20 hours comes back as a reasoned finding in parallel, in about one to two hours.
Here’s the proof.
- Zapier cut triage from 10 to 15 minutes to under 2 minutes, an 85% reduction.
- UiPath saved 700+ analyst hours and cut false positives by 86%.
- Assala Energy hit 100% alert investigation and a 5x faster response time with a lean team.
This way of agentic thinking through difficult threat investigations can reduce time-to-identification and take a lot of work and false positives out of the human analyst’s queue. For every detection, the agent provides a full investigation read out, including all resources on all devices and IP addresses that were executed, so when a serious issue requires further investigation, a human expert can just drop in on the case with full context.
How humans hunt in packs with agents
Human analysts working in the Dropzone AI dashboard can pull up one of hundreds of hunt packs, each bundling five to ten hunts the AI Threat Hunter runs together against, horizontal or vertical-specific threat scenarios.
For instance, a bank may have new OCC requirements (DORA requirements in Europe) for maintaining customer account privacy and handling exceptions that occur within their Open Banking initiative to communicate with other institutions. This may include loading up threat hunts to look into API responses and test communication with other institutions.
The human analyst has a real-time monitoring view of all hunt packs currently in operation, but if any hunt reveals a deeper problem, they can view all of the recent agentic scans and investigation results, as well as getting the hunt report for each, with its timeline and findings.
Or, equally importantly, we need to tell agents what NOT to focus on, in order to save cycle time and cost, as well as reducing the number of false positives of every hunt. For instance, a university realized that almost all students were playing some games on their school laptops. So long as there are no other indicators of compromise, ignoring alerts about students’ gaming sessions and game binary downloads frees up the team to look for more serious threats like ransomware and model poisoning attempts.
In these situations, human analysts can write custom rules, which are really just plain English prompts, that tell agent fleets what to focus on, and what to ignore.
The Intellyx Take
When time is always running out, you really should bend the rules of the game to win. Especially, if the other side isn’t playing fair.
Threat hunting agents can use all of the deterministic tools available in the enterprise estate to detect attacks and close in on vulnerabilities, but success is not really about the tooling. It’s about reusing learnings and insights over time to continuously improve the efficiency and effectiveness of the entire Dropzone AI Agent team.
After all, agents that just follow rote procedures and check for anomalies across an inventory are just MDR and runbook automation tools by another name, and the SOC probably already owns plenty of those.
Working together, security analysts and AI Threat Hunter agents can clear the queue of noisy alerts that don’t have significant impact. Instead, get a headstart for every threat hunt, quickly move from hypothesis to resolution, and spend less time chasing dead ends.
.png)