Kaspersky LLM filters cut false positives by 99%

A Securelist feature by Artemy Obukhov on 30 October 2026 explains how organisations can automate the generation of filters to cut false positives in security alerts. The piece lays out three approaches: a purely algorithmic method, a large language model (LLM) based approach, and a multi-agent LLM system. In the algorithmic setup, a 400-field event from an alert is pared down to the most relevant fields, with string normalization and careful avoidance of filters that simply mirror the original detection rule. FP-Growth is used to build and rank field combinations, producing a short list of candidate filters for analyst selection.

When using an LLM, the process feeds the alert, the chosen fields, and the triggering rule into the model, which then generates three filter options with explanations. A single-system-prompt, non-validated LLM approach was contrasted with multi-agent configurations. The article details an agent-based variant (Selector, Generator, Validator, Commentator) to improve validation and correction, at the cost of slower performance and increased model dependence. Across examples, two filters tended to be valid, while one was too broad.

Evaluating the system used two metrics: approval rate (whether analysts select at least one suggested filter) and false positive reduction rate (FP drop) over time. In head-to-head comparisons, LLM-based generation substantially improved efficiency, with both agentless and agent-based approaches performing similarly.

The headline takeaway is that an LLM with a single system prompt offered the best balance of speed and accuracy, cutting false positives by 99%, boosting daily filter generation by 28%, and making analysts’ alert handling about 17% more efficient. The article attributes these findings to the respective methodologies and experimental results.