--- title: When the sensor starts thinking: SnortML, agentic AI,... description: SnortML is a machine learning detection engine embedded natively in Snort 3, using an LSTM model to classify HTTP parameters for SQL injection, XSS, and... canonical: https://daily.dev/posts/when-the-sensor-starts-thinking-snortml-agentic-ai-and-the-evolving-architecture-of-intrusion-det-1gicixae1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: When the sensor starts thinking: SnortML, agentic AI, and the evolving architecture of intrusion detection | daily.dev og:description: SnortML is a machine learning detection engine embedded natively in Snort 3, using an LSTM model to classify HTTP parameters for SQL injection, XSS, and... og:url: https://daily.dev/posts/when-the-sensor-starts-thinking-snortml-agentic-ai-and-the-evolving-architecture-of-intrusion-det-1gicixae1 og:image: https://api.daily.dev/og/posts/1GICixaE1.png og:image:alt: When the sensor starts thinking: SnortML, agentic AI, and the evolving architecture of intrusion detection og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # When the sensor starts thinking: SnortML, agentic AI, and the evolving architecture of intrusion detection **[Stack Overflow Blog](https://daily.dev/sources/stackov)** · 26 min read · 0 upvotes · 0 comments ## Summary SnortML is a machine learning detection engine embedded natively in Snort 3, using an LSTM model to classify HTTP parameters for SQL injection, XSS, and command injection with sub-millisecond inference on-device. Unlike signature-based rules, it generalizes across syntactic variants of known attack classes, addressing the exposure window between novel exploits and rule availability. The architecture runs ML classification in parallel with traditional signature matching, with each providing independent coverage and different error profiles. However, SnortML is limited to HTTP parameter space and per-request context, with no visibility into multi-request attack sequences or non-HTTP protocols. Agentic AI platforms (IBM ATOM, Trend Micro Agentic SIEM) address these gaps by maintaining state across multi-step investigations, correlating signals from SIEM, identity providers, and threat intel, and automating triage while keeping humans in the loop for containment. The article proposes a full integration architecture from packet capture through agentic reasoning, identifies the missing feedback loop from confirmed incidents back to ML retraining, and outlines open research problems including cross-flow temporal modeling, LLM-assisted rule generation, adversarial robustness evaluation, and agentic investigation quality metrics. Practical deployment guidance recommends starting SnortML in passive monitoring mode, treating ML scores as one factor in composite confidence, and automating investigation while keeping humans in containment decisions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is SnortML and how does it work inside Snort 3? SnortML is a machine learning detection engine Cisco Talos added natively to Snort 3 in March 2024, running fully on-device with no cloud dependency. It uses an embedding layer plus an LSTM neural network to score HTTP URI query strings and POST bodies for exploit probability, returning a verdict in under a millisecond (roughly 350 microseconds on a 4.7 GHz AMD processor) via the LibML inference library using XNNPACK acceleration. _Teams tuning Snort deployments track engine changes like this one on daily.dev to keep detection pipelines current._ ### What attack types can SnortML detect and what are its blind spots? SnortML initially targeted SQL injection detection, with coverage expanded by late 2025 to include XSS and command injection. It only operates on individual HTTP parameters (URI query strings and POST bodies), so it cannot correlate multi-request attack sequences over time and has no visibility into non-HTTP traffic such as DNS tunneling, TLS-layer attacks, or SMB exploitation. _daily.dev helps security engineers weighing detection coverage gaps stay current on Snort and IDS capability changes._ ### How should SnortML be deployed to avoid false-positive-driven outages? Deploy SnortML passively on a monitoring tap first rather than inline with block-on-detection, capturing alerts as events and measuring the false positive rate against known-good traffic for at least two weeks across normal business cycles. In Cisco FMC, set the GID:411 rule to alert-only during this evaluation period before enabling blocking or selective inline deployment. _Engineers rolling out ML-based IDS features can track deployment lessons like this through daily.dev._ ## Similar posts on daily.dev - [Salt Security adds native AI detection and response to agentic security platform](https://daily.dev/posts/salt-security-adds-native-ai-detection-and-response-to-agentic-security-platform-wwcfsbnvn) · IT Security Guru · 0 upvotes · 0 comments - [AI Agents are Man-in-the-Middle Attacks](https://daily.dev/posts/ai-agents-are-man-in-the-middle-attacks-e3lrkzowt) · Security Boulevard · 0 upvotes · 0 comments - [Building an Agentic SOC on a Stream](https://daily.dev/posts/building-an-agentic-soc-on-a-stream-cnmrukzap) · Confluent Blog · 0 upvotes · 0 comments - [How to build agentic AI when your data can’t leave the network](https://daily.dev/posts/how-to-build-agentic-ai-when-your-data-can-t-leave-the-network-hjt8b8rvd) · LogRocket · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#machine-learning](https://daily.dev/tags/machine-learning), [#agentic-ai](https://daily.dev/tags/agentic-ai) [View this post on daily.dev](https://daily.dev/posts/when-the-sensor-starts-thinking-snortml-agentic-ai-and-the-evolving-architecture-of-intrusion-det-1gicixae1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"When the sensor starts thinking: SnortML, agentic AI, and the evolving architecture of intrusion detection","url":"https://daily.dev/posts/when-the-sensor-starts-thinking-snortml-agentic-ai-and-the-evolving-architecture-of-intrusion-det-1gicixae1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/when-the-sensor-starts-thinking-snortml-agentic-ai-and-the-evolving-architecture-of-intrusion-det-1gicixae1"},"datePublished":"2026-07-06T16:20:48.999Z","dateModified":"2026-09-13T18:49:42.201Z","description":"SnortML is a machine learning detection engine embedded natively in Snort 3, using an LSTM model to classify HTTP parameters for SQL injection, XSS, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/caede0ec5a2c969d4794908938ee83a3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/caede0ec5a2c969d4794908938ee83a3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Stack Overflow Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Stack Overflow Blog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/003e14873238469caea60ebdd34508ae","url":"https://daily.dev/sources/stackov"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/when-the-sensor-starts-thinking-snortml-agentic-ai-and-the-evolving-architecture-of-intrusion-det-1gicixae1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,machine-learning,agentic-ai","timeRequired":"PT26M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Stack Overflow Blog","item":"https://daily.dev/sources/stackov"},{"@type":"ListItem","position":3,"name":"When the sensor starts thinking: SnortML, agentic AI, and the evolving architecture of intrusion detection"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/when-the-sensor-starts-thinking-snortml-agentic-ai-and-the-evolving-architecture-of-intrusion-det-1gicixae1#faq","mainEntity":[{"@type":"Question","name":"What is SnortML and how does it work inside Snort 3?","acceptedAnswer":{"@type":"Answer","text":"SnortML is a machine learning detection engine Cisco Talos added natively to Snort 3 in March 2024, running fully on-device with no cloud dependency. It uses an embedding layer plus an LSTM neural network to score HTTP URI query strings and POST bodies for exploit probability, returning a verdict in under a millisecond (roughly 350 microseconds on a 4.7 GHz AMD processor) via the LibML inference library using XNNPACK acceleration. Teams tuning Snort deployments track engine changes like this one on daily.dev to keep detection pipelines current."}},{"@type":"Question","name":"What attack types can SnortML detect and what are its blind spots?","acceptedAnswer":{"@type":"Answer","text":"SnortML initially targeted SQL injection detection, with coverage expanded by late 2025 to include XSS and command injection. It only operates on individual HTTP parameters (URI query strings and POST bodies), so it cannot correlate multi-request attack sequences over time and has no visibility into non-HTTP traffic such as DNS tunneling, TLS-layer attacks, or SMB exploitation. daily.dev helps security engineers weighing detection coverage gaps stay current on Snort and IDS capability changes."}},{"@type":"Question","name":"How should SnortML be deployed to avoid false-positive-driven outages?","acceptedAnswer":{"@type":"Answer","text":"Deploy SnortML passively on a monitoring tap first rather than inline with block-on-detection, capturing alerts as events and measuring the false positive rate against known-good traffic for at least two weeks across normal business cycles. In Cisco FMC, set the GID:411 rule to alert-only during this evaluation period before enabling blocking or selective inline deployment. Engineers rolling out ML-based IDS features can track deployment lessons like this through daily.dev."}}]} ```