Researchers propose a framework for using small language models to translate natural language queries to Kusto Query Language (KQL) for efficient and accurate threat hunting in security operations centers. They evaluate nine models and find that a two-stage approach with a low-cost LLM judge achieves high syntax and semantic accuracy.