Policy-Guided Threat Hunting: An LLM enabled Framework with Splunk SOC Triage
Authors: Rishikesh Sahay, Bell Eapen, Weizhi Meng, Md Rasel Al Mamun, Nikhil Kumar Dora, Manjusha Sumasadan, Sumit Kumar Tetarave, Elyson De La Cruz
Organizations: Department of Management Information Systems, University of Illinois, Springfield, USA · School of Computing and Communications, Lancaster University, United Kingdom · School of Computer Applications, Kalinga Institute of Industrial Technology, India · School of Information Technology and Artificial Intelligence, University of Cumberlands, USA
With frequently evolving Advanced Persistent Threats (APTs) in cyberspace, traditional security solutions approaches have become inadequate for threat hunting for organizations. Moreover, SOC (Security Operation Centers) analysts are often overwhelmed and struggle to analyze the huge volume of logs received from diverse devices in organizations. To address these challenges, we propose an automated and dynamic threat hunting framework for monitoring evolving threats, adapting to changing network conditions, and performing risk-based prioritization for the mitigation of suspicious and malicious traffic. By integrating Agentic AI with Splunk, an established SIEM platform, we developed a unique threat hunting framework. The framework systematically and seamlessly integrates different threat hunting modules together, ranging from traffic ingestion to anomaly assessment using a reconstruction-based autoencoder, deep reinforcement learning (DRL) with two layers for initial triage, and a large language model (LLM) for contextual analysis. We evaluated the framework against a publicly available benchmark dataset, as well as against a simulated dataset. The experimental results show that the framework can effectively adapt to different SOC objectives autonomously and identify suspicious and malicious traffic. The framework enhances operational effectiveness by supporting SOC analysts in their decision-making to block, allow, or monitor network traffic. This study thus enhances cybersecurity and threat hunting literature by presenting the novel threat hunting framework for security decision-making, as well as promoting cumulative research efforts to develop more effective frameworks to battle continuously evolving cyber threats.
Figures & tables
Threat Hunting Technique
Anomaly Assessment
Traffic Flows Prioritization
Initial Triage
Agentic AI/LLM Integration
MITRE Mapping
SIEM Integration and Validation
SOAR Suggestion
SOC Decision Support
Learned Policy adaptation
Agentic AI for Autonomous Threat Hunting Sheth et al. [2025b]
Yes
No
No
Yes
No
No
No
Yes
Partial
Agentic AI for Adaptive Threat Response Sheth et al. [2025a]
Yes
No
No
Yes
No
No
No
Yes at high-level (Partial)
Partial
Unified Framework for Human-AI Collaboration Simbian [2025] , Mohsin et al. [2025]
Conceptual
Partial
No
Yes
No
Yes at high-level
No
Yes
No
NetMon AI Framework Zambare et al. [2025]
Yes
No
Yes
Yes
No
No
No
No
No
ARGOS Agentic Detection Gu et al. [2025]
Yes
No
No
Yes
No
No
No
No
No
LLM for Threat Intelligence and Automation Tseng et al. [2024]
No
No
No
LLM integration
No
No
No
Partial
No
Table 1: Comparison between existing LLM and Agentic AI based threat hunting techniques