GreyNoise built an AI agent — Orbie — that operates on internet-scale honeypot data to surface emergent threats, identify campaigns, and write detection rules. We're sharing what works, what doesn't, and the specific campaigns we caught that traditional methods missed. You'll see how domain expert knowledge embedded in tooling lets LLMs operate on billions of network sessions, and why that matters more than the model you choose.