Security analysts face an overwhelming deluge of alerts from Network Intrusion Detection Systems (NIDS) like Snort. Many of these alerts lack context, making it tough to distinguish real threats from noise. Could AI help connect these alerts to real-world attack techniques? Researchers explored this question by testing the ability of Large Language Models (LLMs) like ChatGPT, Claude, and Gemini to label NIDS rules with tactics and techniques from the MITRE ATT&CK framework, a knowledge base of adversary behavior. The results revealed a fascinating interplay between the strengths of LLMs and traditional Machine Learning (ML). While LLMs offered explainable and scalable initial mappings, suggesting their potential for generating hypotheses and aiding less experienced analysts, traditional ML models trained on labeled data consistently achieved higher precision and recall. Specifically, an SVM model trained by Gemini achieved the highest F1-score of 0.87 for technique labeling and 0.92 for tactic labeling. This suggests a future where human analysts use LLMs to get a first look at complex alerts and then rely on finely-tuned ML models for accurate classification within critical systems. The research highlights the potential of a hybrid approach, combining the reasoning of LLMs with the precision of ML, to strengthen our defenses against ever-evolving cyber threats. This offers a glimpse into a future where AI-powered tools empower security teams to react faster and more effectively to attacks.