iThelma: An Autonomous LLM Agent for Cyber Threat Hunting via Playbook-Driven Intelligence

We present an autonomous agent for cyber threat hunting that integrates structured knowledge from human-authored playbooks with the generative and reasoning capabilities of large language models (LLMs). Building on a prior LLM-based threat-hunting framework, this work introduces additional components for playbook ingestion, hunt script validation, co-occurrence modeling, prompt-based generation, and tuning-based adaptation. The agent generates, validates and refines hunt scripts in a sandboxed environment, identifies behaviorally consistent scripts using consensus voting, and constructs a threat co-occurrence matrix to inform hunt scheduling. Unlike the earlier system that relied solely on natural language prompting, our design enables the agent to learn from execution feedback and adapt its models over time. This work contributes a scalable, self-adaptive and resilient foundation for LLM-driven cyber threat hunting systems.