---
title: "Discussion on \"Building a Threat Hunting Agent from Scratch — What Broke, and Why It Matters\" | Hashnode"
description: "Discussion on \"Building a Threat Hunting Agent from Scratch — What Broke, and Why It Matters\". Built a threat hunting agent using rules first, then LLMs. Every stage broke. Here is what each failure taught me about signal vs noise."
url: "https://hashnode.com/posts/building-a-threat-hunting-agent-from-scratch-what-broke-and-why-it-matters/69f0850e10a70b33358d1cdc"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Building a Threat Hunting Agent from Scratch — What Broke, and Why It Matters](https://mavericksec.hashnode.dev/building-a-threat-hunting-agent-from-scratch-what-broke-and-why-it-matters?utm_source=hashnode&utm_medium=feed)

Built a threat hunting agent using rules first, then LLMs. Every stage broke. Here is what each failure taught me about signal vs noise.

Apr 28 · 5 min read · mavericksec.hashnode.dev  
Updated Aug 18  
Read the article

-   [#threat-hunting](https://hashnode.com/tag/threat-hunting)
-   [#alert-triage](https://hashnode.com/tag/alert-triage)
-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)

## Written by

[Manju Lalwani](https://hashnode.com/@infrashield)

@infrashield · India

  
[View profile](https://hashnode.com/@infrashield)

Blue Team | Purple Team | Threats, Detections & Cloud Things | Women in Cyber 🛡️

I’m a Security Engineer with 12+ years of experience spanning across the security spectrum — from Application Security and DLP to Email Security, Threat Modeling, and Detection Engineering. I started out in AppSec and secure design reviews, grew through DLP and email controls, and evolved into a threat-focused engineer obsessed with solving real-world problems using data, cloud, and smart detection. 🔍 These days, I specialize in building scalable, threat-informed detection pipelines for cloud-native, container-heavy environments — where Detection Engineering meets Data Engineering. Whether it’s turning packets into signal or crafting long-term log ingestion strategies, I love working at the intersection of: 💡 Threat detection 🛰️ Cloud & Kubernetes 🧠 Data pipelines With hands-on experience across GCP, AWS, Kubernetes, Kafka, and behavioral analytics, I bring deep technical understanding paired with a strong sense of mission. I'm a huge advocate for women in cybersecurity, and I genuinely love what I do. This isn’t just a career — it’s a passion. Whether it’s breaking down a complex detection problem, helping someone break into the field, or pushing for better representation, I bring everything I’ve got. I believe in doing meaningful work, mentoring with intention, and showing up as my full self in the field.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.