Small language models just outperformed GPT-5 at one of the more tedious jobs in a security operations center: turning a plain-English question into a working database query.
Researchers tested a system for converting natural-language questions into Kusto Query Language (KQL), the syntax analysts use to search Microsoft security telemetry. They tried three approaches: prompting a small model with a handful of mined tips about common parsing errors, fine-tuning a small model with chain-of-thought reasoning borrowed from a larger teacher model, and pairing a small model that drafts a query with a separate, cheap large model that checks and fixes it against the schema. That third, two-stage approach worked best. On Microsoft's own NL2KQL Defender evaluation set, it produced syntactically correct queries 98.7% of the time and semantically correct ones 90.6% of the time, topping every other setup the researchers tested, including pipelines built on GPT-4o (87.8%) and GPT-5 (86.1%).
The bigger news is cost. That two-stage small-model pipeline handled the researchers' 230-query test set for $0.213, versus $2.018 for the GPT-5 version and $2.998 for the GPT-4o version - a 9.5x to 14x reduction, while still beating both on schema accuracy. For security teams drowning in telemetry and short on analysts who can write KQL, a translator that is both cheaper and more accurate is a rare combination, not an incremental one.
The fine-tuning experiment, notably, went nowhere: teaching the small model to reason like a bigger one never beat prompting it well in the first place - a useful reminder that more training isn't always the fix vendors promise.