Agent-based searching over heterogeneous data sources

1 . A method for querying heterogeneous cybersecurity data, comprising:

determining a data map representation for available data sources, the data map representation indicating relationships between the available data sources, the available data sources having at least one of different storage architectures or different query languages;

determining a query intent associated with an input query by identifying entities and context associated with the input query;

determining a query intent task by mapping the query intent to a relevant data source in the available data sources according to the data map representation and the entities and context;

executing the query intent task with a search agent parameterized for searching the relevant data source; and

outputting a result of an executed query intent task.

2 . The method of claim 1 , further comprising:

determining multiple query intent tasks by mapping the query intent to multiple relevant data sources in the available data sources according to the data map representation, and the entities and context; and

executing the multiple query intent tasks with one or more search agents, the one or more search agents including the search agent.

3 . The method of claim 1 , further comprising:

determining multiple query intent tasks by mapping the query intent to multiple relevant data sources in the available data sources according to the data map representation, and the entities and context;

executing the multiple query intent tasks with multiple search agents individually parameterized for searching the multiple relevant data sources;

enhancing results of the multiple query intent tasks by causing communication of information relevant to the query intent among the multiple search agents, the information relevant to the query intent determined by the multiple search agents as part of executing the multiple query intent tasks;

aggregating the results of the multiple query intent tasks; and

outputting the result based on an aggregation of the results of the multiple query intent tasks.

4 . The method of claim 3 , further comprising:

determining multiple sub-query intents associated with the input query by identifying the entities and context associated with the input query; and

determining the multiple query intent tasks by mapping the multiple sub-query intents to one or more relevant data sources according to the data map representation, and the entities and context.

5 . The method of claim 3 , wherein the information relevant to the query intent comprises at least one of insights conveying relevant data for satisfying the input query or a result from a given search agent's query intent task.

6 . The method of claim 3 , wherein causing the communication of information relevant to the query intent among the multiple search agents comprises providing output from one search agent as additional input to another search agent for performing that search agent's query intent task.

7 . The method of claim 1 , wherein the relationships between available data sources comprise at least one of semantic similarities, joinable fields, common labels, or metadata indicative of commonalities between data in the available data sources.

8 . The method of claim 1 , wherein determining the data map representation comprises generating at least one of descriptions or metadata for the available data sources, the descriptions or metadata configured to enhance semantic understanding of data in an available data source.

9 . The method of claim 1 , wherein the data map representation is determined using various semantic functions, wherein a semantic function:

comprises an algorithm configured to capture meaning behind data in the available data sources, rather than surface-level structure of the data in the available data sources;

is configured to provide information about how to query the relevant data source; and

is configured to provide information about how data between two or more different available data sources is related.

10 . The method of claim 1 , wherein entities comprise tokens associated with at least one of specific, identifiable items or concepts that have meaning within the input query, and wherein the entities are associated with an application of interest.

11 . The method of claim 1 , wherein context comprises tokens associated with at least one of surrounding information, background, or situational factors present in the input query that influence determining the query intent associated with the input query.

12 . The method of claim 1 , wherein determining the query intent associated with an input query comprises decomposing the input query by evaluating qualifiers in the input query related to at least one of the entities or the context.

13 . A system for querying heterogeneous cybersecurity data, comprising:

a processor; and

memory storing instructions that, when executed by the processor, cause the processor to:

determine a query intent associated with an input query by identifying entities and context associated with the input query;

determine a query intent task by mapping the query intent to a relevant data source according to a data map representation, and the entities and context and the data map representation indicating relationships between the relevant data source and other available data sources;

execute the query intent task with a search agent parameterized for searching the relevant data source; and

output a result of an executed query intent task.

14 . The system of claim 13 , wherein the instructions further cause the processor to:

determine multiple query intent tasks by mapping the query intent to multiple relevant data sources in the available data sources according to the data map representation, and the entities and context; and

execute the multiple query intent tasks with one or more search agents, the one or more search agents including the search agent.

15 . The system of claim 13 , wherein the instructions further cause the processor to:

determine multiple query intent tasks by mapping the query intent to multiple relevant data sources in the available data sources according to the data map representation, and the entities and context;

execute the multiple query intent tasks with multiple search agents individually parameterized for searching the multiple relevant data sources;

enhance results of the multiple query intent tasks by causing communication of information relevant to the query intent among the multiple search agents, the information relevant to the query intent determined by the multiple search agents as part of executing the multiple query intent tasks;

aggregate the results of the multiple query intent tasks; and

output the result based on an aggregation of the results of the multiple query intent tasks.

16 . The system of claim 15 , wherein the instructions further cause the processor to:

determine multiple sub-query intents associated with the input query by identifying the entities and context associated with the input query; and

determine the multiple query intent tasks by mapping the multiple sub-query intents to one or more relevant data sources according to the data map representation, and the entities and context.

17 . A non-transitory computer readable medium having instructions thereon, the instructions, when executed by a computer, causing the computer to perform operations for querying heterogeneous cybersecurity data comprising:

determining a data map representation for available data sources, the data map representation indicating relationships between the available data sources, the available data sources having at least one of different storage architectures or different query languages;

determining multiple sub-query intents associated with an input query by identifying entities and context associated with the input query;

determining multiple query intent tasks by mapping the multiple sub-query intents to multiple relevant data sources in the available data sources according to the data map representation and the entities and context;

executing the multiple query intent tasks with multiple search agents individually parameterized for searching the multiple relevant data sources;

enhancing results of the multiple query intent tasks by causing communication of information relevant to the multiple sub-query intents among the multiple search agents, the information relevant to the multiple sub-query intents determined by the multiple search agents as part of executing the multiple query intent tasks;

aggregating the results of the multiple query intent tasks; and

outputting an aggregated result.

18 . The medium of claim 17 , wherein the information relevant to the multiple sub-query intents comprises at least one of insights conveying relevant data for satisfying the input query or a result from a given search agent's query intent task.

19 . The medium of claim 17 , wherein causing the communication of information relevant to the multiple sub-query intents among the multiple search agents comprises providing output from one search agent as additional input to another search agent for performing that search agent's query intent task.

20 . The medium of claim 17 , wherein the available data sources comprise a data estate of a user with at least one of databases, data tables, or columns of data.