< Back
Episode #
125

AI Agent Or Info Stealer?

Over 60% of false positives trace back to vendor-provided detection rules. That finding, from a first-of-its-kind SANS report Alex Hurtado helped produce, captured why detection engineering has become its own discipline, one that treats rule management like a CI/CD pipeline.

Alex, Head of Detection Strategy at Nebulock, breaks down how AI is reshaping the detection lifecycle, from query generation to self-healing alert tuning, and flags a critical blind spot where current logs cannot distinguish a legitimate AI agent action from a malicious one.

‍

Topics discussed:

  • Treating detection rule management as a CI/CD pipeline
  • Vendor rules as the leading source of false positives
  • Applying AI to query generation and alert tuning
  • Distinguishing AI slop from actionable threat research
  • Chaining atomic detections across data sources for coverage
  • Closing the visibility gap on AI agent telemetry
  • Open source tools for monitoring AI agent activity

‍

Key Takeaways: 

  •  Treat detection rule management like a CI/CD pipeline to keep pace with evolving environments and shifting attack surfaces.
  • Audit vendor-provided detection rules first when investigating false positive volume, since they account for over 60% of false positives according to the SANS report.
  • Apply AI to query generation and alert tuning so detection engineers spend less time writing SPL, SQL, or AQL and more time on coverage strategy.
  • Chain atomic detections across multiple data sources and TTPs to build behavior-based alert narratives instead of relying on single-event rules.
  • Curate threat intelligence sources manually before feeding them into AI workflows to filter out AI-generated slop masquerading as research.
  • Evaluate open source AI agent telemetry projects like Perplexity's Numbat and Huntress contributor Anton Uvrotsky's A10 to start building visibility into agent activity.
  • Map your detection backlog against both internal environment changes and external threat landscape shifts to prioritize what to build next.

Listen to More Episodes:  YouTube  •  Apple  •  Spotify  •  Website-