IBM Patent Automates the Writing of Threat Hunting Queries Using AI
Security analysts spend enormous chunks of their day reading lengthy threat reports and then manually translating them into search queries to find attackers hiding in their networks. IBM's new patent describes a way to automate that whole translation process using an AI that reads the report and writes the query itself.
How IBM turns threat reports into search queries automatically
Imagine your company's security team gets a fresh report warning about a new cyberattack campaign, describing in paragraph form how hackers break into systems, move around, and steal data. Right now, a human analyst has to read that report, pull out the key warning signs, and then hand-write the search terms your security tools use to look for the same attack on your own network. That process takes time, and tired humans miss things.
IBM's patent describes a system where an AI does that translation automatically. It reads the threat report, builds a kind of map showing how the attack unfolds step by step, and then turns that map into a ready-to-run search query. The query captures both the specific files or software involved (called indicators of compromise) and the patterns of behavior the attackers used.
The goal is to let security teams respond faster. Instead of spending hours writing queries by hand, analysts could get a usable starting point in seconds, then review and refine it rather than building from scratch.
generating, by a computer, using a large language model, a composite graph for a threat report corresponding to a cybersecurity threat by merging subgraphs corresponding to cyberattack-related sentences identified in the threat report into one or more connected graphs …
Translation: The system uses AI to read threat reports and map out the attack details as connected diagrams.
How the AI maps attack sentences into connected graphs
The system works in four main stages, all driven by a large language model (an AI of the same family as ChatGPT, trained on vast amounts of text).
- Sentence extraction: The AI reads a threat report and picks out the sentences that describe actual attack activity, filtering out background or marketing language.
- Graph construction: Each attack-related sentence becomes a small diagram (a subgraph) showing which software, files, or processes interact with each other and how. Those small diagrams are merged into one larger map called a composite graph.
- Indicator identification: The AI analyzes the full map to pull out two types of clues: indicators of compromise (specific artifacts like a suspicious file name or IP address) and indicators of behavior (patterns of what the attacker did, like copying credentials before exfiltrating data).
- Query generation: Plain-language descriptions of both types of indicators are fed back into the AI, which produces a threat hunting query, a structured search command security tools can actually run against log data to look for signs of the same attack.
The patent specifically mentions that the composite graph is built by merging subgraphs into connected graphs, meaning the AI links sentences that share the same system entities so the full attack chain is preserved rather than treated as isolated events.
A threat hunting query corresponding to the cybersecurity threat is generated based on the descriptions of the indicators of compromise associated with the system entities and the indicators of behavior associated with the subgraphs comprising the composite graph.
Translation: It automatically writes code that security teams can use to hunt for that specific threat.
What this means for security teams drowning in threat reports
For security teams, the bottleneck has never been having too few threat reports. It's always been having too many, with too little time to act on them. Every hour an analyst spends manually translating a report into search queries is an hour an attacker might be moving through a network undetected. A system that automates that translation could meaningfully shrink response windows, especially for smaller teams that don't have an army of experienced analysts.
The patent is software-only, which means IBM doesn't need new hardware to ship something here. The main dependency is a large language model capable enough to reliably parse security-specific language and produce accurate queries, and that bar is already within reach of current AI systems. IBM's security division already sells products in this space, so the shortest path from this filing to a real feature is an integration into an existing platform rather than a ground-up build. Coverage of cybersecurity new Big Tech patents consistently shows that AI-assisted threat detection is one of the most active areas of IP investment right now, and IBM is staking out the query-generation slice of that market.
This is the 305th IBM filing in our IBM coverage since May, adding to work like rebuilding images from fragments and sorting records by text prediction.
IBM's pipeline here is pure software. It reads existing threat reports, runs them through language models, and produces ready-to-use search queries for security teams, with no new hardware or data formats required. The shortest route to a product is connecting this to a live feed of threat intelligence reports inside a security monitoring platform and letting analysts test the output against real incidents.
The main unknown is whether the generated queries are accurate enough to trust, since the patent is quiet on how the system handles vague or poorly written threat reports, which are common in practice. That gap matters because a bad query either floods analysts with false alarms or misses the attack entirely.
If IBM can show reliable output on messy real-world data, this could meaningfully cut the manual work analysts spend translating threat reports into actual searches.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
7 drawing sheets from US 2026/0254828 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →