Custom AI Prompting in Uncoder AI Enables On-Demand Detection Generation

How It Works

Writing detection rules often starts with a question: What am I trying to find, and under what conditions? But even the best threat intel reports don’t come prepackaged in platform-ready syntax.

Uncoder AI’s Custom Prompt Generation bridges that gap. This feature allows users to input natural language descriptions of the behavior they want to detect — and automatically receive platform-specific query logic in response.

In the provided example, a user asks for three Splunk queries to detect APT29-related activity in environments where Windows logging is limited to defaults. Uncoder AI responds with:

• Detection logic targeting PowerShell misuse (Invoke-Command, Invoke-Expression)
• Credential access attempts (lsass.exe)
• Domain-related enumeration and manipulation

Each query is written in Splunk SPL, complete with filtering logic, regex usage, event count thresholds, and user-friendly annotations.

Explore Uncoder AI

Why It’s Innovative

Rather than selecting pre-built rules from a library, analysts can generate fresh detection content by describing exactly what they need. This is made possible by:

• LLM-backed processing (Llama 3.3) tuned specifically for detection engineering and threat behavior modeling
• Hosted in SOC Prime’s SOC 2 Type II private cloud, ensuring maximum IP protection and no external API dependency
• Ability to handle context-rich prompts — adapting queries to constrained environments, specific actor profiles, or known event log limitations

Unlike rigid rule templates, these prompts adapt to reality.

Operational Value

• On-Demand Detection Generation: Save hours writing rules manually — especially in reactive or incident-driven workflows.
• Tailored to Context: Prompts can reflect actual infrastructure limitations or investigation-specific needs.
• No Need to Master Syntax: Analysts describe the outcome, Uncoder AI writes the logic.

Secure and Private by Design: Data and instructions stay within SOC Prime’s infrastructure.

From Prompt to Precision in a Click

Uncoder AI transforms how SOCs write detections. Instead of digging through rule repositories or tweaking boilerplate templates, analysts just describe what they’re looking for — and Uncoder AI builds the queries. Whether responding to a threat report, reproducing a TTP, or creating environment-specific rules, the result is the same:

High-fidelity, high-context detection logic. Instantly. Privately. At scale.

Explore Uncoder AI