RAGnarok: Assisting Your Threat Hunting with Local LLM

The talk starts from a practical problem: threat hunting involves many repetitive steps, and cloud-hosted language models raise concerns because network configuration and other sensitive data should not leave the organization. The speaker presents Ragnarok, a tool that turns threat intelligence about an attack technique into a Sigma detection rule using a model that runs on a CPU-only machine.

The design combines three ideas. A quantized model reduces the computing resources needed, retrieval-augmented generation pulls reference material such as Sigma guidance and Microsoft documentation from a vector store, and a multi-agent workflow divides the work. For Active Directory techniques, one agent gathers configuration data from an AD mapping tool, stores it in a graph database and queries it for relevant findings. A demo walked through loading and crawling reference documents, generating a rule, converting it to SPL and testing it in a demo environment, with manual review still required.

The lessons were practical. Filtering the MITRE ATT&CK detection text before generation mattered because irrelevant content produced poor rules. Token limits can halt long multi-agent runs, so summarizing context helped. Windows event log formats vary by event ID, which led to a dedicated lookup tool. Chunking by meaningful units such as paragraphs strongly affected accuracy, and large document sets increased indexing time and disk use. The speaker concluded that local models suit sensitive environments, but each technique carries tradeoffs.