Automating LLM interactions

The WebUI is not the only interface we can use to interact with LLMs. During the labs in this chapter, if you entered the same prompt twice, you may have received a different response, or if you turned up the temperature values, there might have been some more interesting use case recommendations. The detection engineering team is likely to utilize multiple websites from researchers beyond the SOC Prime marketplace.

Let’s say we have an RSS feed that monitors multiple security news outlets, and we want to monitor keywords such as exploits, vulnerabilities, and zero-days. We use filtering of those words to increase the likelihood that the site will have TTPs that include IOCs or the payload that we need for detections. We also need to capture only fresh news sources, such as from the last 24 hours.

We can write automations to iterate for the links and keywords needed, and then use them as iterative input for either our chatbot or another public...