We are researching an option to leverage LLMs as a  “translator” between natural language Threat Detection description and tool-specific query language. Trying to fine tune the schema of some acceptable keywords, as “free text only” is currently not pragmatic based on my testing.