What it is
AI Hunt on the Logs page takes a question such as "which hosts talked to 203.0.113.9 in the last day" or "show me PowerShell with encoded commands on servers" and turns it into one or more queries against the store. The queries are shown to you before and after they run, along with the results and a short summary.
What it can do
- Translate a question into the query grammar using the field dictionary, so field names are always canonical.
- Run a bounded number of read-only queries, each within the current organization scope and your grants.
- Summarise what came back and suggest a follow-up question.
- Hand a query to a search tab so you can continue by hand, or promote it to a detection.
Guardrails
- Read-only. AI Hunt queries; it leaves platform state untouched.
- Your scope. It sees exactly the data your grants allow.
- Bounded. The query budget is set in Settings › AI, with time and row limits on each query.
- Tab-scoped. A hunt lives in its search tab; keep the tab open to continue it.
Requirements
AI Hunt needs a model endpoint configured in Settings › AI. The button explains what to configure until one is set. See Model setup. Every hunt is recorded in the audit trail with the queries it ran.