Threat hunters have a problem. Every week brings a stack of DFIR reports, blogs, and advisories full of useful intelligence about how attackers operate. The hard part isn’t finding the intel — it’s turning it into something you can actually use before it goes stale.
Rapid7’s internal security team built a pipeline that does exactly that.
It works in four stages. First, it ingests a threat report — URL or pasted text — and strips out the boilerplate. Then it sends the clean content to an LLM trained to act as a MITRE ATT&CK analyst. The model extracts techniques by ID, tactic, and a summary of how the adversary used them. Defensive recommendations are intentionally excluded — the output focuses on what the attacker did, not what to do about it.
Stage three generates detection queries. LEQL for InsightIDR. VQL for Velociraptor. Sigma rules. YARA where relevant. Every query gets reviewed by a human before use — the pipeline accelerates drafting, not decision-making.
Stage four assembles it all into a structured hunt plan: executive summary, IOC sweep, behavioral hunting queries, and explanations of what each query detects.
The clever part is the query cache. Every generated detection gets saved as a standalone markdown file. Seen a technique before? It loads from the library instead of regenerating. Analysts can tune cached queries over time, and those improvements persist across future hunt plans.
A report that used to take a full week to process can now be operationalized in minutes. For a recent BPFdoor report targeting telecom networks, the pipeline identified 16 techniques across seven ATT&CK tactics and produced detection coverage across InsightIDR, Velociraptor, and Sigma in one pass.
Velociraptor queries stay under manual control — live host interrogation is too invasive to automate fully. But everything else runs on rails.
The takeaway: automating the mechanical work lets hunters hunt. The pipeline turns information overload into an asset that compounds over time.
