BlueHat IL 2026 - Michal Shechter, Yaniv Melamed, Yoni Zukerman

Problem

Microsoft PM Michal Shechter describes converting massive, schema-diverse security telemetry from many vendors into unified behaviors answering who did what to whom—without scalable human experts per log source.

Behaviors vs alerts

Behaviors are neutral, meaningful observations between raw logs and alerts; alerts are suspicious cues requiring analyst time. Example: login profile creation followed by password change, rendered with dynamic entities and MITRE mapping.

Why not just LLMs

Naive one-shot prompting was insufficient for production-grade, accurate detection logic at scale and cost.

Production constraints

Generated logic must execute safely in customer environments, preserve correct semantics for actors/actions/targets, capture true intent, and operate with no human review per rule—automating expertise that traditionally required manual schema mapping across AWS, identity, network, and other sources.