AI
The Problem: Manual Triage at Scale
Miron’s team at UiPath faced two competing demands: reactive incident triage and proactive threat hunting. News-driven requests made it worse. Colleagues read an article about an attack and pinged the team, “Are we impacted?” By the third article in a day, nobody checked carefully. Adding headcount was off the table, three or four years into a tech-wide hiring freeze.
“So instead of adding people we added agents.” — Cristian Miron
The result: a reusable workflow that validates CVE and attack exposure and delivers a threat hunting report in five minutes. Analysts now only hear from it when something actually hits.
The Manual Workflow Before Automation
Before automation, every “are we affected?” message triggered the same manual chain. The analyst acknowledged the request, read the news article, noted each indicator, searched internal documentation for the right log tables and fields, wrote KQL queries, ran them in the SIEM, and, if anything looked relevant, drafted detection rules. Start to finish: at least one hour. Per article. For something that might have zero impact on the infrastructure. The backlog of real projects kept growing while the team ran the same loop one or two times a day.
System Architecture: Agents, RPA, and Orchestration
A form in the team’s enterprise messaging platform starts every run. Submit a link, and the workflow fires: LLM agents with tool-calling ability, RPA for steps that need deterministic output, a deduplication database to block re-analyzed articles, and Maestro as the orchestration layer. The database also timestamps each run so the team can confirm they analyzed the latest version of an article, not stale data. A single-agent demo made the concept concrete: the agent checked internal documentation for the correct log table, ran a KQL query, and returned 70,000-plus authentication events from the past two hours (10:07).
The Agent Fleet: Roles and Parallel Execution
Six agents run in parallel. The article parser extracts public IPs, domains, file hashes, CVE IDs, and NuGet packages. Six enricher agents take those indicators — one per type — and generate KQL queries against the ADX instance. A web searcher finds related articles. A hunting engineer converts TTPs into KQL. If an indicator type is absent from the article, its enricher skips entirely. Parallel fleet execution walkthrough (17:09) shows two agents skip live. All outputs feed the L2 analyst agent, which assesses impact; the documentation agent writes the report and an RPA bot posts it to Confluence.
Output: The Five-Minute Threat Hunting Report
Five minutes after an article triggers the workflow, the report is ready. The completed report shows executive summary, threat actor attribution, MITRE mapping, timeline, and two device names flagged by IOC match (19:15) — all without an analyst touching the article.
“What I hate the most about this threat hunting report is that it’s a constant reminder of my failures because I will never ever go into this many details when it comes to building a threat hunting report. I am lazy.” — Cristian Miron
The final section also includes a KQL detection query and next-action items. At that point, the analyst’s job is remediation, not research.
Lessons Learned and the Road Ahead
Specialized agents outperform generalists here for two reasons: they skip cleanly when their IOC type is absent, and their narrow prompts produce tighter, higher-confidence output. The broader lesson is context supply.
“The more log sources you provide to your agents, the smarter they will be and the larger the area they can cover.” — Cristian Miron
More tools, more internal documentation, more SIEM tables. The team’s planned next steps follow that same logic: auto-publishing confirmed detections to Git and adding a cross-article deduplication agent to stop the same IOC from triggering redundant reports.
Q&A
Have you noticed any overhead on your SIEM from agents running parallel IOC searches? Early agent versions ran unbounded queries that caused spikes, but tightening the time constraints in the prompts brought resource impact down to unnoticeable levels. ▶ 25:06
How much time has the automation saved your team compared to the manual process? No precise metric, but roughly 10 hours per week, with the bigger gain being the elimination of context-switching that broke analysts out of focused work to triage every incoming article. ▶ 25:49
Is there such a thing as too much context for an agent, and have you seen hallucinations when grounding them? No hallucinations from over-grounding, but testing surfaced an endless-loop failure where conflicting prompt instructions caused an agent to get stuck and required a full restart. ▶ 27:15
How do you fine-tune your system prompt, and when do you know it is good enough? Through repeated manual comparison against known-good investigations, plus a self-correcting agent in production that retries with a different query format whenever a search returns zero results. ▶ 30:19
Notable Quotes
So instead of adding people we added agents. Cristian Miron · ▶ 2:48
It provides us with a threat hunting report in 5 minutes from start of the execution. Cristian Miron · ▶ 4:46
What I hate the most about this thread hunting report is that it’s a constant reminder of my failures because I will never ever go into this many details when it comes to building a thread hunting report. I am lazy. Cristian Miron · ▶ 20:23
The more log sources you provide to your agents, the smarter they will be and uh the larger the area they can they can cover. Cristian Miron · ▶ 23:28
Key Takeaways
- Specialize your agents by IOC type so they skip cleanly when that indicator is absent from the article.
- Give agents access to internal documentation and log tools so they generate high-confidence, evidence-backed reports.
- Route news-driven triage to agents first; let human analysts focus only on confirmed hits, not every article.
About the Speakers
Cristian Miron
Cristian Miron is a Security Engineer currently working for UiPath. His career in IT started 14 years ago and for the past 10 he focused his attention to Security. He is passionate about automation ever since he realised that he can work more efficiently if his tasks are scripted: from handling data sets in phishing campaigns to closing alerts which don’t need human interaction and reviewing alerts that have been closed by an engineer, everything should be done with a robot.
Valentin Vatui
Valentin Vatui is a Cybersecurity Engineer with 7 years of experience in the field, currently working at UiPath for the past year and a half. Before specializing in cybersecurity, he spent 4 years as a Network Engineer, gaining valuable expertise in IP networks and optical transmission networks. At UiPath, Valentin works within the Security Operations department, focusing on several key areas including Security Engineering, Threat Hunting, Incident Response, and Security Automation. Valentin holds multiple industry certifications, including GCIH (GIAC Certified Incident Handler) and GCTI (GIAC Threat Intelligence), demonstrating his commitment to professional development and expertise in handling security incidents and threat intelligence.