AI-Assisted Network Threat Hunting: See It, Enrich It, Ask It-BHIS Webcast

[BLUF]
Troy Woda presents "Event Horizon," a custom network security monitoring dashboard that leverages Large Language Models (LLMs) to automate the development of threat hunting tools, addressing common frustrations in data visualization and enrichment 30:29. The session demonstrates how AI-assisted coding can accelerate the creation of efficient, analyst-led threat hunting workflows while maintaining critical human oversight 17:34.

Key Takeaways:
• Threat hunting is fundamentally retroactive detection; effective hunts require a strong baseline of network inventory and structured data storage to distinguish normal behavior from anomalies 36:59.
• Network sensor placement is critical; internal sensors are essential for correlating beaconing activity to specific internal endpoints behind NAT, while external sensors are vital for detecting edge compromises and perimeter attacks 52:05.
• Event Horizon is an alpha-stage tool that visualizes traffic via a "Bird's Eye" view, automatically enriches observables (IPs, domains, hashes) with geolocation and reputation data, and tracks first/last seen timestamps to aid in frequency analysis 21:00.
• Cyber Threat Intelligence (CTI) feeds are often historic; analysts should contextualize open-source IOCs by understanding their age and relevance rather than monitoring them for real-time activity 11:43.
• AI should be used as an assistant for coding and development tasks rather than a replacement for analytical judgment; analysts must maintain "trust but verify" habits to counter AI hallucinations and high-confidence errors 14:45.

Event Horizon is currently in development, with a community version planned for release in the near future. The tool aims to make advanced network telemetry analysis accessible by reducing the barrier to entry for custom tooling development.

Sources:

• 30:29 Introduction to the topic of AI-assisted network threat hunting.
• 36:59 Definition of threat hunting as retroactive detection.
• 52:05 Discussion on internal vs. external sensor placement for network visibility.
• 21:00 Demonstration of the "Bird's Eye" visualization and observable enrichment features.
• 11:43 Analysis of the lifespan and applicability of open-source CTI feeds.
• 14:45 Advice on maintaining critical thinking and verification when using AI tools.