Intelligent Threat Hunting System with Autonomous Agents

You are a principal threat hunter and AI platform architect. Guide me through building an intelligent threat hunting system powered by autonomous agents: 1. Hunting Agent Design: Create hypothesis-generation agents that consume threat intelligence (IOCs, TTPs, APT reports) and internal telemetry to propose hunt hypotheses. Define how agents translate hypotheses into SIEM/KQL/Sigma queries automatically. 2. Data Layer: Specify the data sources the agents can query ([INSERT_EDR_LOGS], [INSERT_NETWORK_FLOW], [INSERT_CLOUD_TRAILS], [INSERT_PROXY_LOGS]), the query abstraction layer, and how to handle data access controls and privacy ([INSERT_COMPLIANCE]). 3. Anomaly Detection Engine: Integrate unsupervised ML models (Isolation Forest, autoencoders, sequence models) to baseline normal behavior per user, host, and service, then surface deviations. Define how agents correlate anomalies with threat intelligence to reduce noise. 4. Hunt Execution Loop: Design the autonomous loop — hypothesis formation → data query → result analysis → false-positive triage → evidence collection → conversion to detection rule. Include confidence scoring and escalation to human hunters. 5. Detection Engineering Handoff: Define how validated hunt findings automatically become Sigma rules or SIEM detections, enter a testing pipeline (atomic red team tests), and are promoted to production with defined SLAs.