Cybercriminals are using generative artificial intelligence (AI) to execute malicious attacks globally while security vendors like SentinelOne use the same technologies in their efforts to counteract these threats. The company introduced an enhanced threat-hunting platform that integrates multiple layers of AI technology during the RSA conference 2023.

SentinelOne has embedded neural networks and a large language model (LLM)-based natural language interface into its threat-hunting platform. However, the vendor hasn't disclosed which generative AI models it uses.

“We use a combination of models from open source and various vendors that are fine-tuned to work within the cybersecurity domain and further calibrated to work within the context of the SentinelOne ecosystem,” SentinelOne Chief Product and Technology Officer Ric Smith told SDxCentral.

The integration allows users to ask threat and adversary-hunting questions and run operational commands to manage their enterprise environment using natural language, the vendor claims.

Smith explained, for example, a threat hunter can ask, “Is my environment infected with SmoothOperator?” Once they receive a response, they can then use another prompt like “Now tell me what kinds of machines are infected with SmoothOperator.” to drill down further on the result set.

When finishing querying, the platform will offer recommendations for the next best actions to aid the investigation and mitigation. In this case, the system might suggest creating a rule to alert on more infections or quarantine the currently infected hosts, he added.

“Like the results, the recommendations will be summarized and delivered in clear, concise, and specific terms that even a layperson can understand, making it easy to take action,” Smith touted.

Generative AI for threat hunting

SentinelOne started its generative AI integration with its threat hunting platform, and later it plans to extend the capabilities to its managed detection and response (MDR) and threat intelligence services, which is expected to offer users faster response times and more actionable intelligence, according to Smith.

“Threat hunting is a top priority across the industry,” he said. “To keep critical infrastructure and data safe, security teams have to manage an ever-growing number of data sources on the scale of petabytes.”

Another issue this integration is addressing is the industry-wide talent shortage. “AI is the key to filling the gap, as it effectively lowers the bar,” Smith noted.

The embedded large language model (LLM)-based natural language interface can help shorten entry-level threat hunters’ learning curve and make veterans more effective by allowing them to ask questions using natural language instead of complex query language and get a summary of results in “simple jargon-free terms.”

Another benefit lies in generative AI’s capability to consume large amounts of data and information, quickly extract key points and adjust responses to a widely comprehensible reading level.

“Looking at [identity management]-related log files in conjunction with EDR log files, for instance, the model can infer that a hunter is looking for lateral movement and summarize any related information identified,” Smith said.

On the flip side, any generative AI model has its limitations, so SentinelOne monitors and validates all the AI-related responses on its platform. “Responses can vary in accuracy, and human validation will be critical in evolving the model,” he noted. “No content generated by the model will be directly presented to customers until we gain enough trust in its accuracy.”

SentinelOne’s generative AI-powered platform vs. Microsoft Security Copilot

Microsoft embedded OpenAI’s GPT-4 into its security portfolio and introduced Microsoft Security Copilot last month.

The new AI tool offers a variety of capabilities, including human-readable explanations of vulnerabilities, threats, and alerts from Microsoft’s own security products and later from third-party tools; answering questions about the enterprise environment and the incidents using natural language; summarizing incident analysis and offering recommendations on next steps; enabling users to edit the prompt to correct or adjust the responses, and share the findings with others.

Smith argues that Microsoft’s Security Copilot as an assistant is “not a direct integration to its platform but a supplement to the experience. Think of it as Clippy [discontinued Microsoft Office Assistant] 2.0.”

He noted SentinelOne is taking a different approach — “empowering our customers to take the wheel and drive now rather than sitting in the co-pilot seat.” And its threat-hunting platform treats AI not just as an assistant, but as "a first-class citizen."

“The accuracy in the limited time we have been testing has proven more beneficial than articulating investigations directly into a query language. And summarization is now displayed for all result sets and individual events,” Smith noted. “We plan to take the same approach to enrich our platform with AI going forward.”