Effective and Efficient Threat Hunting with Small Language Models

Small language models can translate natural language to Kusto Query Language using error-aware prompting and lightweight retrieval. While LoRA fine-tuning with rationale distillation was tested, targeted prompting proved more effective than fine-tuned variants for addressing common parser failures. This framework enables security analysts to query telemetry streams without specialized KQL expertise.