# Policy-Guided Threat Hunting: An LLM enabled Framework with Splunk SOC Triage

arXiv: https://arxiv.org/abs/2603.23966 · HTML: https://mlsanity.com/paper/2603.23966/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 10 of its 43 references that are in the map.
- First posted on arXiv 25 Mar 2026.

## Builds on (most cited first, 10 of 10)

- [Proximal Policy Optimization Algorithms](https://mlsanity.com/paper/1707.06347/) (2017)
- [Deep Learning for Anomaly Detection: A Survey](https://mlsanity.com/paper/1901.03407/) (2019)
- [Exploration of LLM Multi-Agent Application Implementation Based on LangGraph+CrewAI](https://mlsanity.com/paper/2411.18241/) (2024)
- [A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypes](https://mlsanity.com/paper/2601.05293/) (2026)
- [Argos: Agentic Time-Series Anomaly Detection with Autonomous Rule Generation via Large Language Models](https://mlsanity.com/paper/2501.14170/) (2025)
- [Using LLMs to Automate Threat Intelligence Analysis Workflows in Security Operation Centers](https://mlsanity.com/paper/2407.13093/) (2024)
- [A Unified Framework for Human AI Collaboration in Security Operations Centers with Trusted Autonomy](https://mlsanity.com/paper/2505.23397/) (2025)
- [NetMoniAI: An Agentic AI Framework for Network Security & Monitoring](https://mlsanity.com/paper/2508.10052/) (2025)
- [MiniMaxAD: A Lightweight Autoencoder for Feature-Rich Anomaly Detection](https://mlsanity.com/paper/2405.09933/) (2024)
- [Turning the Hunted into the Hunter via Threat Hunting: Life Cycle, Ecosystem, Challenges and the Great Promise of AI](https://mlsanity.com/paper/2204.11076/) (2022)

## Abstract (arXiv)

With frequently evolving Advanced Persistent Threats (APTs) in cyberspace, traditional security solutions approaches have become inadequate for threat hunting for organizations. Moreover, SOC (Security Operation Centers) analysts are often overwhelmed and struggle to analyze the huge volume of logs received from diverse devices in organizations. To address these challenges, we propose an automated and dynamic threat hunting framework for monitoring evolving threats, adapting to changing network conditions, and performing risk-based prioritization for the mitigation of suspicious and malicious traffic. By integrating Agentic AI with Splunk, an established SIEM platform, we developed a unique threat hunting framework. The framework systematically and seamlessly integrates different threat hunting modules together, ranging from traffic ingestion to anomaly assessment using a reconstruction-based autoencoder, deep reinforcement learning (DRL) with two layers for initial triage, and a large language model (LLM) for contextual analysis. We evaluated the framework against a publicly available benchmark dataset, as well as against a simulated dataset. The experimental results show that the framework can effectively adapt to different SOC objectives autonomously and identify suspicious and malicious traffic. The framework enhances operational effectiveness by supporting SOC analysts in their decision-making to block, allow, or monitor network traffic. This study thus enhances cybersecurity and threat hunting literature by presenting the novel threat hunting framework for security decision-making, as well as promoting cumulative research efforts to develop more effective frameworks to battle continuously evolving cyber threats.