At a glance
The challenge
Threat hunting finds the attacks that alert rules miss. But our hunters were spending around 60% of their time preparing hunts, which limited how often they could look.
The impact
An AI hunting agent now handles the research and query drafting. Our team runs twice as many hunts, and delivered 15 new or improved detections in the first quarter.
Key services
AI-assisted research
Query generation
Threat hunting
Detection engineering
Technologies
Microsoft Sentinel
Microsoft Defender
Alert rules only catch what they're written to catch
The most careful attackers know how to stay under the radar. They avoid the patterns alert rules look for, and they're patient. Threat hunting is how we find them: experienced people actively searching for signs of trouble that nothing has flagged yet.
But getting a hunt ready takes real effort: researching how attackers behave, writing queries, and sorting the results. Our hunters were spending around 60% of their time on preparation, which limited how often they could look beyond our existing detections.
Freeing hunters to hunt
We introduced an AI hunting agent to take on the preparation. It handles the research and drafts the queries, so our hunters can put their expertise where it counts: the analysis.
The agent supports threat research, drafts the searches our hunters run, and flags anything unusual in the results. Our hunters check what it finds and turn the useful evidence into better detection rules. That way, every hunt makes our day-to-day monitoring stronger.
How it works
Threat researched
:The agent gathers what's known about how a particular attacker behaves.
Queries drafted
:It writes the searches our hunters need to look for that behaviour.
Anomalies flagged
It highlights anything unusual in the results.
Hunter investigates
:Our hunters check the findings and turn them into new detection rules.
Every hunt makes the next one better
A hunt that finds nothing still teaches us something. And when it does find something, we don't just deal with it once. Our hunters turn what they've learned into new detection rules, so the next time that behaviour appears, our monitoring catches it automatically.
What's changed
We've cut hunt preparation time by 60%, so the team now runs twice as many hunts each month. In the first quarter alone, those hunts produced 15 new or improved detection rules. Our customers get wider coverage, and a clearer view of the gaps that still need attention.
"The AI takes care of the legwork, so we spend our time thinking like an attacker. That's where the real finds come from."
Head of Security Operations, ITPS
Why it matters
No set of alert rules will ever catch everything. Proactive hunting closes the gap, but only if you can do enough of it. By doubling how often we hunt, we're finding more of what's hiding, and making our customers' everyday protection stronger with every hunt.
Less noise. Clearer priorities. Faster action.
Our AI agents do the groundwork, and our analysts make the calls. Let’s talk about what that could mean for your security.
