Join us at hack.lu 2026 — Info & Registration

Duration: 120 min

Type: Training

Speakers: Peter Manev, Eric Leblond

Abstract

HHAMMERRing the Noise: AI-Agentic Threat Hunting with Suricata and the Power of EVE Metadata

This workshop introduces HHAMMERR, a specialized threat hunting framework designed for modern detection engineering: Hypothesis, Hunt, Analyze, Modulate, Manage, Enhance, Refine, and Repeat. Built on the philosophy of “hunt manually once, automate forever,” the session demonstrates how to move beyond traditional query-based methods into cost-effective, high-accuracy AI integration.

Using Suricata—the industry-standard open-source network analysis engine—as the primary data source, attendees will explore how to leverage its rich protocol, flow, and anomaly logs for deep network visibility. The workshop bridges the gap between traditional SIEM-based hunting and Agentic AI, focusing on building precise “AI Skills” rather than simply processing massive datasets.

Key Takeaways:

  • Methodology: Implementation of the HHAMMERR cycle to standardize hunting workflows.
  • Optimization: Techniques for building Agentic AI tools that prioritize data sovereignty, performance, and low token costs.
  • Practical Application: Hands-on malware hunt scenarios designed to provide immediate, actionable value for blue teams.

Moving past the hype of generative AI, this session provides a pragmatic roadmap for defenders to illuminate perimeter blind spots and automate complex detection tasks using the Claude AI plugin ecosystem and Suricata’s network security data.

Description

Claude AI hunting plugins for Suricata

Optimizing for cost effective and accurate theta hunting AI SKILLs while keeping the token costs, hallucinations and False Positives low.

This workshop will explore the HHAMMERR threat hunting concept specifically developed for threat detection engineering. It utilizes different traditional and nontraditional based techniques for successful threat hunting regardless of the query tools used - old/new/legacy/SIEM queries/rules/AI etc.
It lives off the routine - Hypothesis , Hunt (trigger), Analyze, Modulate, Manage , Enhance, Refine , Repeat.

The concept is based on the simple goal idea of: Hunt manually only once. Automate every hunt.

As a perfect example we will be using Suricata’s network security data. Suricata is one of the most dominant and widely deployed Open Source network threat detection software systems currently available. Suricata is a high performance, open source network analysis and threat detection software used by most private and public organizations, and embedded by major vendors to protect their assets. Suricata provides network protocol, flow, alert, anomaly logs, file extraction and PCAP capture at very high speeds.

The workshop will review different techniques for achieving successful hunts:

Manual / using traditional SIEM toolings, queries and rules
Agentic AI enhanced and build on top of the manual hunt findings and lessons learned. Mainly optimizing for cost effective and accurate AI SKILLs building for the AI or the AI agents

The workshop will walk attendees through requirements, tips and tricks of using Agentic AI - including optimizing it for cost and performance - as opposed to throwing massive amounts of data at the AI algorithms which is not always optimal in terms of cost and results (with data sovereignty in mind).

Suricata concentrates a lot of power and visibility for the blue teams and enables them to shed light in the dark and blind spots of your defense perimeter. As such it is perfect for providing the extra layer of protection in the organisation and end users.

The workshop will concentrate on useful hands-on scenarios and actual malware hunts rather than hype and conceptual high level talk. The attendees are expected to walk out with actual examples and learnings that can be immediately implemented in their own environments.

View on pretalx