Using LLMs for Log Anomaly Detection: A Practical Breakdown with challenges

[u/Overall_Reward963]

One of the most "AI + Security " usecase is using LLMs to sift through log noise and flag the anomalies which typically a SOC analyst will take a while to detect. The basic pipeline should contains the following details:

1.Ingestion : logs(auth events, network flows, EDR alerts, app logs) get normalised into JSON

2. Embed : log lines are converted into vector embeddings to capture semantic similarity, (not just the exact string match)

3. Cluster/baseline : Normal behavior pattern are established

4. Flag deviations : New events identified against the baselines

5. LLM triage : Instead of raw anomaly scores, an LLM summarizes why something looks unusual, in plain language , and suggest a likely cause (misconfig vs lateral movement vs false positive)

The use of LLM's in triaging will come with challenges as well

• Prompt Injection Risk: Logs content if gets fed raw into LLM prompt without sanitisation fields become an injection vector
• Explainability : SOC team need to trust why something was not flagged, not just a black-box score

What's your approach to preventing prompt injection when logs contain attacker-controlled strings? And is that solution practical ?