LLM-generated filters cut false positives by 99% and speed up analyst work

The five-minute version

The writeup describes three approaches to automatically generate filters for false-positive security alerts: a pure algorithmic method using FP-Growth, a single-prompt LLM method, and a multi-agent LLM pipeline. Each system takes a false-positive alert, selects relevant fields, and produces three candidate filters for analyst approval. In internal testing the LLM-based approaches achieved a 99% reduction in false positives, a 28% increase in filters generated per day, and a 17% boost in analyst efficiency, while the algorithmic method performed adequately when sufficient context existed. The authors note trade-offs such as slower response time for the agent-based version and reliance on model availability.

What they found 2

• LLM-based filter generation reduced false positives by 99% and improved analyst efficiency by 17%

  “cut false positives by 99%, increased the number of filters generated per day by 28%, and made analysts’ alert handling 17% more efficient.”

• Algorithmic approach still produced acceptable filters in two-thirds of cases despite lower scores

  “The algorithmic approach scored lower on the evaluation metrics, but in two-thirds of cases, it still produces filters that satisfy the analyst.”

What undercuts it the paper’s own results

• The algorithmic method cannot create a filter when no context exists (e.g., first-ever rule trigger).
• The single-prompt LLM approach returns filters without syntax validation, risking malformed rules.
• The multi-agent LLM pipeline incurs more model calls, making the system slower.

Stated limits 4

• If there’s no context for some reason - for example, the rule’s first-ever trigger - a filter can’t be created.
• The LLM returned filters as-is, with no syntax check and no way to correct errors.
• The approach makes more LLM calls than the previous ones, so the system is slower.
• It depends on access to a model, which may not be available in isolated environments.

What’s new here 4

• Application of FP-Growth to prune field combinations for filter creation.
• Use of a single-prompt LLM to generate filters without needing prior context.
• Introduction of a multi-agent LLM workflow (selector, generator, validator, commentator) for validation and explanation.
• Quantitative evaluation showing 99% false-positive reduction and 17% analyst efficiency gain.

Artifacts & methods 4

• FP-Growth algorithmprimitive
• LLM (single system prompt)system
• LLM agents (selector, generator, validator, commentator)system
• filter generation pipelinesystem

Topics