Techniques for generating natural language context in an issue tracking system

1 . A method for generating a natural language context from a ticket management system, comprising:

receiving an unstructured natural language query from a client device;

generating a first prompt for a first large language model (LLM) based on: a predefined template and the unstructured natural language query, the first prompt when processed by the first LLM outputs a structured database query;

executing the structured database query on a database, wherein the database stores a representation of a cloud computing environment, and wherein the representation includes:

a plurality of ticket nodes, each ticket node representing a ticket generated based on an alert; and

at least one ticket group node representing a ticket group, wherein each ticket node belonging to the ticket group is connected in the database to the at least one ticket group node;

wherein the database comprises a graph database in which each ticket node corresponds to an alert received from a cybersecurity monitoring system and is connected by a membership relationship to a ticket group node representing tickets sharing at least one common alert attribute;

wherein executing the structured database query comprises querying the database to identify ticket nodes connected to a selected ticket group node;

generating a second prompt for a second LLM based on a result of executing the structured database query, the second prompt when processed by the second LLM outputs a natural language response; and

sending the natural language response to the client device.

2 . The method of claim 1 , further comprising:

generating the first prompt further based on: the predefined template, the unstructured natural language query, and a database schema of the database.

3 . The method of claim 2 , further comprising:

generating the second prompt further based on: the result of executing the structured database query and the database schema of the database.

4 . The method of claim 1 , further comprising:

generating the representation of the cloud computing environment.

5 . The method of claim 4 , further comprising:

receiving a plurality of alerts from a cybersecurity monitoring system configured to monitor the cloud computing environment;

generating a plurality of tickets in a ticket management system based on the received plurality of alerts; and

generating a plurality of ticket groups from the plurality of tickets, each ticket group including a subset of tickets of the plurality of tickets.

6 . The method of claim 5 , further comprising:

generating a node in the database representing each ticket group of the plurality of ticket groups.

7 . The method of claim 6 , wherein the result of executing the structured database query includes an identifier of a ticket group of the plurality of ticket groups.

8 . The method of claim 1 , wherein the first LLM includes a first context length, and the second LLM includes a second context length.

9 . A computing environment for generating a natural language context from a ticket management system, the computing environment comprising processing circuitry configured to:

receive an unstructured natural language query from a client device;

generate a first prompt for a first large language model (LLM) based on: a predefined template and the unstructured natural language query, the first prompt when processed by the first LLM outputs a structured database query;

execute the structured database query on a database, wherein the database stores a representation of a cloud computing environment, and wherein the representation includes:

a plurality of ticket nodes, each ticket node representing a ticket generated based on an alert; and

at least one ticket group node representing a ticket group, wherein each ticket node belonging to the ticket group is connected in the database to the at least one ticket group node;

wherein the database comprises a graph database in which each ticket node corresponds to an alert received from a cybersecurity monitoring system and is connected by a membership relationship to a ticket group node representing tickets sharing at least one common alert attribute;

wherein executing the structured database query comprises querying the database to identify ticket nodes connected to a selected ticket group node;

generate a second prompt for a second LLM based on a result of executing the structured database query, the second prompt when processed by the second LLM outputs a natural language response; and

send the natural language response to the client device.

10 . The computing environment of claim 9 , wherein the processing circuitry is further configured to:

generate the first prompt further based on: the predefined template, the unstructured natural language query, and a database schema of the database.

11 . The computing environment of claim 10 , wherein the processing circuitry is further configured to:

generate the second prompt further based on: the result of executing the structured database query and the database schema of the database.

12 . The computing environment of claim 9 , wherein the processing circuitry is further configured to:

generate the representation of the cloud computing environment.

13 . The computing environment of claim 12 , wherein the processing circuitry is further configured to:

receive a plurality of alerts from a cybersecurity monitoring system configured to monitor the cloud computing environment;

generate a plurality of tickets in a ticket management system based on the received plurality of alerts; and

generate a plurality of ticket groups from the plurality of tickets, each ticket group including a subset of tickets of the plurality of tickets.

14 . The computing environment of claim 13 , wherein the processing circuitry is further configured to:

generate a node in the database representing each ticket group of the plurality of ticket groups.

15 . The computing environment of claim 14 , wherein the result of the structured database query includes an identifier of a ticket group of the plurality of ticket groups.

16 . The computing environment of claim 9 , wherein the first LLM includes a first context length, and the second LLM includes a second context length.

17 . A non-transitory computer-readable medium for generating a natural language context from a ticket management system, the non-transitory computer-readable comprising instructions that, when executed, cause processing circuitry to execute steps of:

receiving an unstructured natural language query from a client device;

generating a first prompt for a first large language model (LLM) based on: a predefined template and the unstructured natural language query, the first prompt when processed by the first LLM outputs a structured database query;

executing the structured database query on a database, wherein the database stores a representation of a cloud computing environment, and wherein the representation includes:

a plurality of ticket nodes, each ticket node representing a ticket generated based on an alert; and

at least one ticket group node representing a ticket group, wherein each ticket node belonging to the ticket group is connected in the database to the at least one ticket group node;

wherein the database comprises a graph database in which each ticket node corresponds to an alert received from a cybersecurity monitoring system and is connected by a membership relationship to a ticket group node representing tickets sharing at least one common alert attribute;

wherein executing the structured database query comprises querying the database to identify ticket nodes connected to a selected ticket group node;

generating a second prompt for a second LLM based on a result of executing the structured database query, the second prompt when processed by the second LLM outputs a natural language response; and

sending the natural language response to the client device.

18 . The non-transitory computer-readable medium of claim 8 , wherein the steps further include:

generating the first prompt further based on: the predefined template, the unstructured natural language query, and a database schema of the database.

19 . The method of claim 1 , further comprising:

assigning a view-indicator value to each ticket node and each ticket-group node; and

generating an initial visualization that renders ticket nodes and ticket-group nodes having a view-indicator value equal to a predetermined base value.

20 . The method of claim 1 , further comprising:

assigning a severity score to each ticket node based on a severity indicated by the alert on which the respective ticket node is generated.