What it is
AI Hunt on the Logs page takes a hunt theory such as "encoded PowerShell followed by outbound connections from workstations" and investigates it by driving the page itself: it writes queries, sets filters and columns, pages through results and pivots on what it finds. Every step is shown in the hunt panel as it happens.
What you get
- A step-by-step trail of what the agent searched and why.
- A verdict with findings. Each finding lists the observations it cites; a finding with no citation is marked as a claim, not a fact.
- The page left on the agent's last search, filters and columns, so you can continue by hand. From the tab menu you can then save the search as a view or promote it to a detection rule.
Guardrails
- Read-only. AI Hunt only searches; it changes nothing.
- Your scope. It sees exactly the data your grants allow.
- Bounded. A hunt runs at most 12 steps. Queries that would scan too much are refused before they run, and the agent is asked to narrow them.
- Stoppable. Press Stop in the hunt panel at any time and take over.
Requirements
AI Hunt needs a model configured in Settings › AI; see Model setup. Without one, a fixed demo sequence runs instead and gives no verdict. Every query the agent runs is recorded in the audit log.
Feedback
Mark a hunt's verdict as right or wrong, with a sentence on what went wrong. Later hunts on the same theory take it into account.