Let’s be brutally honest for a second: out-of-the-box LLMs are like that one extremely confident junior analyst who just finished a boot camp. They’ve read all the manuals, they know exactly what a where clause is, and they will absolutely swear on their life that a table named WindowsMagicLogEvents_Pls_Work exists in your tenant.
They hallucinate. They guess. They break the build.
For a while, the cybersecurity industry tried to fix this by slapping a shiny “AI” sticker on generic text wrappers, hoping the model would magically learn the nuances of enterprise telemetry. It didn’t. Then, we tried to route everything through SIGMA as a universal translator. We don’t want generic, lowest-common-denominator abstractions. We want native, highly optimized, platform-specific code.
So, we decided to fix the AI. We took the lobotomy route, stripping the model of its creative freedom and grounding it in cold, hard reality using Retrieval-Augmented Generation (RAG).
Welcome to the new HEFAISTOS backend, where our Maieutic Engine finally stops making things up.
The Problem: Why Generative AI Sucks at Detection Engineering
Detection engineering is about precision. If you are hunting for T1003.001 (OS Credential Dumping: LSASS Memory), you cannot have an AI guessing if the schema uses DeviceName or DeviceId, or if it should use has instead of contains for performance.
When you click “GENERATE WITH AI” in a standard web terminal, the LLM is flying blind. It doesn’t know your environment’s naming conventions, custom log pipelines, or the specific dialect of KQL (or SPL, or EQL) your SIEM uses. The result? A query that looks syntactically beautiful but throws a massive red error when executed because the target table doesn’t actually exist.
The Solution: Weaponizing thousands KQL Rules
To cure the hallucinations, we didn’t just tweak the system prompt. We built a localized brain. We took thousands highly curated, production-validated KQL rules, stripped out the noise, and built a dynamic structural memory bank.
Here is how the architecture actually works under the hood when you mash that generate button in the HEFAISTOS Workbench:
1. The Vector Database (Qdrant)
Instead of feeding the LLM raw text, we use Qdrant to store our validated rules as vector embeddings in a unified collection named hefaistos_rule_templates. Every time an analyst requests a rule, the backend executes a semantic similarity search. If you ask for “malicious PowerShell execution,” Qdrant instantly surfaces three historically perfect rules from our repository that match that exact systemic behavior.
2. The RabbitMQ Async Pipeline
We didn’t bolt on a brittle, standalone FastAPI sidecar. We routed the entire RAG pipeline through our existing Django + GraphQL + RabbitMQ infrastructure. The retrieval process is injected directly into the startGenerateRuleTask worker. It’s asynchronous, highly scalable, and doesn’t clog up the primary REST endpoints.
3. Strict Context Injection
Before the AI even sees your prompt, the RabbitMQ worker staples those retrieved Qdrant templates—along with their exact, required data schemas—to the request.
The AI is explicitly ordered to stop being creative. The prompt essentially says: “Do not invent tables. Use ONLY these exact schemas. Use this syntax structure. Now, fulfill the user’s request natively in KQL.”
Workbench Visibility: Trust, But Verify
We know what you’re thinking. “How do I know the AI didn’t just ignore the context?”
Because detection engineers are inherently paranoid, we exposed the backend’s thought process directly to the frontend UI. In the Multi-Platform Editor, we implemented a toggleable Reference Context pane. You can literally click a button to slide out a panel that shows you the exact historic rules, schemas, and metadata the backend injected into the AI’s brain for that specific query. You see what the AI saw.
Dropping the SIGMA Crutch & Looking Ahead
By explicitly tagging our payload metadata with language="KQL", the platform generates native Kusto directly.
And the best part? The architecture is already wired for the future. The Qdrant collection and the RabbitMQ run_scheduler.py sync loop are designed to pull from the RuleRepository directly out of GitHub. This means the system will soon sync and embed EQL (Elastic), SPL (Splunk), and WAZUH XML templates automatically. You just configure the dataset path in the Repos administration tab, set the cron schedule, and the platform continuously updates the AI’s reference brain without you lifting a finger.
The days of debugging an LLM’s imaginary NetworkTraffic_Stuff table are officially over. Now, get back to hunting.