HHAMMERRing the Noise: AI-Agentic Threat Hunting with Suricata and the Power of EVE Metadata#

Speakers not listed in the program text

• Why: Two reasons for you: EVE metadata is the richest structured network telemetry an open-source NDR produces, and this is a pragmatic look at how agentic AI actually gets integrated into network defense (cost, false positives, data sovereignty) rather than the usual hype.
• What: The HHAMMERR cycle (Hypothesis, Hunt, Analyze, Modulate, Manage, Enhance, Refine, Repeat) — "hunt manually once, automate forever" — applied to Suricata protocol/flow/anomaly/file-extraction logs, with hands-on malware hunt scenarios. The AI angle is building small, precise "AI skills" over curated telemetry instead of dumping datasets at a model, explicitly optimizing token cost, hallucination, and FP rates via the Claude plugin ecosystem.
• How: Manual hunt on Suricata EVE output first; findings get encoded as repeatable, low-cost agent skills against the same structured logs.
• Where applicable: Any organization running Suricata at the perimeter; general technique, not org-specific. Caveat: no speakers are listed in the program, so provenance couldn't be checked, and the Claude-ecosystem specifics may age quickly — judge the EVE-metadata workflow on its own merit. (from abstract only)