LLM-Driven Query Generation for Enhanced Threat Investigation

Investigating security alerts often requires writing complex queries in specialized languages to uncover indicators of compromise (IOCs) and other critical signals. This process is slow, error-prone, and highly dependent on analyst expertise. This thesis will explore the use of Large Language Models (LLMs) to automatically generate accurate investigative queries. The focus will be on evaluating query correctness and effectiveness in retrieving relevant security artifacts such as IOCs, with the goal of improving investigation speed and reliability.