For detection engineering teams, the bigger the scale, the harder it becomes to answer the most basic question: how many attacks did we actually catch this week? Answering that requires dedicated investigation time for every threat. Static funnels help reduce the load, but they don't scale. Well - they didn't, until we brought AI into the loop. We built an AI investigation pipeline to scale our hunt for true positives surfaced by the detection engine.

Before touching any data, the AI analyzes threat semantics - understanding the rule's intent, what a real attack would look like, and what benign scenarios could trigger it. It then executes the same multi-step workflow a human researcher follows: gathering detection context, profiling actor history, verifying IP reputation, and cross-referencing asset inventory - corroborating evidence across sources before reaching a verdict. The system scales through parallel agents, each independently investigating batches of threats, updating results in real-time and generating live dashboards.

Then something unexpected happened. As confirmed true positives accumulated, we noticed the AI was consistently flagging attacker techniques our rules had missed. The idea was obvious - why not use those conclusions to write new rules? So we built exactly that: a pipeline where every verified attack feeds into automated TTP gap analysis, and the AI drafts detection rules for techniques we didn't cover.

In this talk, we'll share how we encoded expert investigative reasoning into AI skills, the rule creation pipeline, and real examples of AI-generated rules now running in production.