Full Report
Before delegating work to AI, ask one question: can you check the output? A detection engineer on why verification, not trust, decides what tasks you hand over.
Analysis Summary
# Best Practices: AI Delegation in Detection Engineering
## Overview
These practices address the operational risks of using Large Language Models (LLMs) and agentic workflows in cybersecurity. The core philosophy is **Verification-Driven Delegation**: a task should only be handed to AI if the human operator has a fast, scalable way to verify the output. This prevents "hallucinated" security rules that lead to SOC fatigue or missed attacks.
## Key Recommendations
### Immediate Actions
1. **Apply the "Checkability" Filter:** Before prompting AI for a task (e.g., writing a detection rule), identify exactly how you will verify the result. If the review takes longer than doing the work manually, do not delegate it.
2. **Audit Existing "AI-Generated" Rules:** Review rules created by LLMs to ensure they aren't based on "wrong denominators"—such as flagging common Microsoft identifiers (like the Outlook Desktop Client) as malicious simply because they appeared in a single compromised mailbox.
3. **Implement the Generation-Verification Loop:** Move away from "vending machine" prompting. Require a loop where the AI generates, a human/system checks, and the AI refines based on the feedback.
### Short-term Improvements (1-3 months)
1. **Standardize Scoping Queries:** Build a library of "denominator" datasets. When an AI suggests a malicious indicator, immediately run it against your entire environment (or a wider customer base) to check its frequency and avoid false positives.
2. **Automate Metric Checks:** Create automated scripts to answer three questions for every AI-proposed rule:
* Does an existing rule already cover this?
* Does it fire on the target malicious activity?
* What is the estimated monthly alert volume (FP rate)?
### Long-term Strategy (3+ months)
1. **Shift to Agentic Workflows:** Move from simple chat interfaces to agentic systems where the AI is programmed to perform its own "bounded passes" (testing and prototyping) before presenting results to a human engineer.
2. **Continuous Evaluation Framework:** Develop a system where the "cost of review" is near zero, using automated diffs against "known-good" configurations or automated red-team simulations to validate AI output.
## Implementation Guidance
### For Small Organizations
- **Focus on Triage:** Use AI to summarize logs, but manually verify any indicator (IP, Hash, App ID) against public databases (e.g., VirusTotal, Microsoft Catalog) before blocking.
- **Manual Loops:** Run the generation-verification loop manually by asking the AI to "Find errors in your own logic" before finalizing a task.
### For Medium Organizations
- **Structured Data Feeds:** Ensure the LLM has access to structured, wide-scope datasets so it doesn't make scoping mistakes based on a single organization’s data.
- **Pre-defined Checklists:** Provide engineers with a checklist of "verification steps" they must complete before any AI-generated detection goes live.
### For Large Enterprises
- **Agentic SOC Workflows:** Integrate AI agents that automatically check new detection prototypes against historical "Big Data" to project false positive rates.
- **Verification Tooling:** Invest in "nearly free" review tools, such as automated CI/CD pipelines for detection-as-code that run AI rules against telemetry sandboxes.
## Configuration Examples
While specific code wasn't provided, the text outlines a **Verification Logic Flow** for a Detection Rule Agent:
1. **Step 1 (Scope):** Human defines the malicious behavior and organization context.
2. **Step 2 (Prototype):** AI generates the rule logic.
3. **Step 3 (Verify - Scoping):** AI runs a query: `count(events) where ID = [AI_Suggested_ID]` across all tenants.
4. **Step 4 (Refine):** If `count > threshold`, AI discards ID and searches for a rarer, more precise indicator.
## Compliance Alignment
- **NIST Cybersecurity Framework (ID.RA):** Ensures risk assessments of automated tools are accurate.
- **CIS Controls (Control 8):** Audit Log Management and the creation of accurate alerts.
- **ISO/IEC 42001:** Alignment with Artificial Intelligence management systems regarding output verification.
## Common Pitfalls to Avoid
- **The Denominator Trap:** Assuming an indicator is malicious because it is rare in one mailbox, without checking how common it is globally.
- **Vending Machine Prompting:** Trusting the first output without a verification loop.
- **High Review Costs:** Delegating tasks where the human review is so complex it negates the time saved by the AI.
## Resources
- **Latent Space - The Generation-Verification Loop:** [latent[.]space/p/s3]
- **Huntress Blog (Detection Engineering):** [huntress[.]com/blog]
- **Microsoft 365 App ID Catalog:** (Searchable via Microsoft Documentation)