Prompt-Based Threat Hunting

Most security tools react: they wait for an alert to fire. Threat hunting is different. It's proactively going looking for trouble that no alert caught yet, asking "what would an attacker do, and can I find traces of it?" Traditionally this required learning complex query languages. With AI, you can hunt by describing what you're looking for in plain English. This lesson turns your curiosity into a repeatable hunting skill.

What You'll Learn

• What threat hunting is and how it differs from waiting for alerts
• How to form a "hypothesis" and turn it into a plain-English hunt
• How to use AI to generate search queries and interpret results
• A starter set of hunts every beginner should know

Hunting vs. Reacting

Imagine two security guards. One sits by an alarm and only moves when it rings. The other walks the building, checking doors and looking for anything out of place. Both matter, but the walking guard catches the clever intruder who avoided the alarm. Threat hunting is walking the building.

A hunt starts with a hypothesis: a specific, testable guess about how an attacker might be operating. Good hypotheses are concrete. Not "are we hacked?" but "if an attacker stole an employee's password, I'd expect to see logins from a new country at odd hours." Then you go look for evidence for or against it.

The Hunt Loop

Threat hunting follows a simple, repeatable loop:

1. Hypothesize — State what an attacker would do and what trace it would leave.
2. Search — Look through your data (logs, sign-ins, alerts) for that trace.
3. Analyze — Examine what you find: is it benign, or a real lead?
4. Respond or refine — Escalate a real finding, or refine the hypothesis and hunt again.

AI helps at every step: brainstorming hypotheses, writing the search, and interpreting results.

Step 1: Brainstorm Hypotheses with AI

Stuck on where to look? Ask AI to think like an attacker (defensively):

Role: Threat-hunting mentor.
Task: I protect a small company with email, a website, and cloud
file storage. Give me 5 concrete threat-hunting hypotheses a
beginner could investigate, each with the specific log or data
source I'd check and the pattern that would confirm it.
Format: numbered list.

You'll get testable ideas like "impossible travel: the same user logs in from two distant countries minutes apart," or "a dormant account suddenly becomes active." Each is a hunt you can run.

Step 2: Turn a Hypothesis into a Search

Here's where AI shines for beginners. Many security platforms use query languages (like KQL in Microsoft Sentinel, SPL in Splunk, or plain SQL). You don't have to memorize them. Describe the hunt and ask AI to draft the query:

Role: You write security search queries.
Task: I use Microsoft Sentinel (KQL). Write a query to find user
accounts that had 10 or more failed sign-ins followed by a
successful sign-in within 10 minutes, in the last 24 hours.
Explain each line in plain English so I can learn.

The AI drafts the query and teaches you what it does. Important: treat generated queries as drafts. Read the explanation, run them in a safe/test environment first, and verify the results make sense. AI can get a field name or function slightly wrong, so you confirm before trusting.

Step 3: Interpret the Results

Finding hits is not the same as finding an attack. Most hunts turn up benign explanations, and that's normal. Feed results back to AI for a second opinion:

Role: SOC analyst.
Task: My hunt for impossible travel returned the rows below.
For each, tell me whether it looks like a real threat or a likely
benign explanation (like a VPN or a traveling employee), and what
single follow-up check would resolve it.
Rows: [paste sanitized results]

This is the heart of hunting: separating scary-looking-but-innocent from genuinely suspicious. A VPN can look like impossible travel; a shared service account can look like odd behavior. AI helps you reason through the alternatives, and you make the call.

Starter Hunts Every Beginner Should Know

Practice these four classic hunts (against test data or with AI-generated sample logs):

• Impossible travel — one account, two far-apart locations in a short window.
• Brute force that worked — many failed logins then a success from one source.
• Dormant account wakes up — an account with no activity for months suddenly logs in.
• Access to sensitive resources — a normal user account suddenly reads admin files or hits /admin, /.env, or a database export.

Ask AI to generate a small fictional dataset for each so you can practice the full loop safely:

Create a small fictional log sample (10 lines) that contains one
hidden "impossible travel" case among normal activity, so I can
practice spotting it. Then wait; don't reveal the answer yet.

Try to spot the planted case yourself, then ask the AI to reveal it. This turns learning into a game and builds real instincts.

Keep the Human in the Loop

Threat hunting produces leads, not verdicts. AI can generate a hypothesis, write a query, and explain results, but it cannot know your environment's normal, cannot see the full context, and can be confidently wrong. Every promising lead gets human verification before you act (isolate a machine, disable an account, alert a team). You are the hunter; AI is the very fast, very knowledgeable dog that points, then you decide whether to shoot.

Key Takeaways

• Threat hunting is proactively looking for attacks no alert caught, unlike reacting to alarms.
• Start with a concrete, testable hypothesis about what an attacker would do and the trace it leaves.
• Follow the hunt loop: Hypothesize, Search, Analyze, Respond or refine.
• Use AI to brainstorm hypotheses, draft search queries in languages like KQL/SPL/SQL, and interpret results, but always verify generated queries in a safe environment first.
• Learn the classic hunts (impossible travel, brute force, dormant accounts, sensitive access), and keep a human in the loop for every real lead.