De-coupled security information and event management system, and method thereof

1 . A computer implemented method for a federated search across multiple different SIEM tools connected to a plurality of target data sources, comprising:

receiving an input query at a SIEM federated search engine wherein the input user query is either in a format of an SQL query or a natural language query wherein input query is entered by a user attempting to retrieve information from multiple SIEM tools;

determining, using plurality of potential cyber incident views, target Cyber Data Sources (CDS's) from the plurality of target data sources to query;

determining, using a large language model (LLM), at least one matching cyber-incident view from the plurality of potential cyber incident views to serve an input query, when at least one matching cyber-incident view lists the plurality of target cyber data sources (CDSs), and wherein the matching cyber-incident view is determined based on an incident that a user intends to investigate based on the plurality of potential cyber incident views, wherein the cyber-incident view includes an intermediate view and a normalized view;

querying each of the plurality of target CDSs, wherein each of the plurality of target CDSs is quired with a respective native query, wherein the respective native query corresponds to the input query;

retrieving results from the plurality of target CDSs in response to the respective native query;

normalizing retrieved results based on the matching cyber-incident view, wherein normalized results displayed all the retrieved results, wherein normalizing the retrieved results further comprises:

mapping the retrieved results to an intermediate format using the intermediate view; and

mapping the retrieved results from the intermediate format to a normalized format using the normalized view; and

displaying the normalized results in unified response to the input query.

2 . The method of claim 1 , wherein the normalized format is a cybersecurity schema framework Open Cyber Security Schema Framework (OCSF).

3 . The method of claim 1 , wherein the input query is any one of an SQL query or a natural language query.

4 . The method of claim 1 , wherein determining at least one matching cyber-incident view further comprises:

analyzing the input query to determine the user intent for the requested results for the incident to be investigated; and

identifying a cyber-incident matching the user's purpose for the requested results.

5 . The method of claim 1 , wherein a cyber-incident view is a standard query language (SQL) view pertaining to the detection and investigation of cyber incidents.

6 . The method of claim 5 , wherein the cyber incidents include any one of: threat detection, security incidents, compliance, user activity monitoring, network traffic analysis, and vulnerability management.

7 . The method of claim 1 , further comprising:

correlating the retrieved results to remove duplicated entries.

8 . The method of claim 7 , further comprising mapping sources in each the Cyber Data Source (CDS) to the intermediate view, wherein the sources include any one of: formats, tables, data locations, schemas, and the like.

9 . The method of claim 7 , further comprising:

generating the cyber-incident view using at least a retrieval-augmented generation (RAG) process.

10 . The method of claim 9 , further comprising:

tuning, using an AI model, an output of the RAG process to detect inaccuracy in the cyber-incident view generated using the RAG process.

11 . The method of claim 1 , wherein querying each of the plurality of target CDSs further comprises:

for each of the plurality of target CDSs,

generating the respective native query complaint with a respective target CDS; and

querying the respective target CDS with the respective native query.

12 . The method of claim 11 , wherein generating the respective native query includes converting the input query to the respective native query compliant with specifications of respective target CDS.

13 . The method of claim 11 , wherein the respective native query includes an API request.

14 . A non-transitory computer-readable medium storing a set of instructions for a federated search across multiple different SIEM tools connected to a plurality of target data sources, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

receive an input query at a SIEM federated search engine wherein the input user query is either in a format of an SQL query or a natural language query wherein input query is entered by a user attempting to retrieve information from multiple SIEM tools;

determine, using plurality of potential cyber incident views, target Cyber Data Sources (CDS's) from the plurality of target data sources to query;

determine, using a large language model (LLM), at least one matching cyber-incident view from the plurality of potential cyber incident views to serve an input query, when at least one matching cyber-incident view lists a plurality of target cyber data sources (CDSs), and wherein the matching cyber-incident view is determined based on an incident that a user intends to investigate based on the plurality of potential cyber incident views, wherein the cyber-incident view includes an intermediate view and a normalized view;

query each of the plurality of target CDSs, wherein each of the plurality of target CDSs is quired with a respective native query, wherein the respective native query corresponds to the input query;

retrieve results from the plurality of target CDSs in response to the respective native query;

normalize retrieved results based on the matching cyber-incident view, wherein normalized results displayed all the retrieved results in a consistent manner, wherein the one or more processors, when normalizing the retrieved results, are configured to:

map the retrieved results to an intermediate format using the intermediate view; and

map the retrieved results from the intermediate format to a normalized format using the normalized view; and

display the normalized results in response to the input query.

15 . A system for a federated search across multiple different SIEM tools connected to a plurality of target data sources, comprising:

one or more processors configured to:

receive an input query at a SIEM federated search engine wherein the input user query is either in a format of an SQL query or a natural language query wherein input query is entered by a user attempting to retrieve information from multiple SIEM tools;

determine, using plurality of potential cyber incident views, target Cyber Data Sources (CDS's) from the plurality of target data sources to query;

determine, using a large language model (LLM), at least one matching cyber-incident view from the plurality of potential cyber incident views to serve an input query, when at least one matching cyber-incident view lists a plurality of target cyber data sources (CDSs), and wherein the matching cyber-incident view is determined based on an incident that a user intends to investigate based on the plurality of potential cyber incident views, wherein the cyber-incident view includes an intermediate view and a normalized view;

query each of the plurality of target CDSs, wherein each of the plurality of target CDSs is quired with a respective native query, wherein the respective native query corresponds to the input query;

retrieve results from the plurality of target CDSs in response to the respective native query,

normalize retrieved results based on the matching cyber-incident view, wherein normalized results displayed all the retrieved results in a consistent manner, wherein the one or more processors, when normalizing the retrieved results, are configured to:

map the retrieved results to an intermediate format using the intermediate view; and

map the retrieved results from the intermediate format to a normalized format using the normalized view; and

display the normalized results in response to the input query.

16 . The system of claim 15 , wherein a cyber-incident view is an SQL view pertaining to detection and investigation of cyber incidents.

17 . The system of claim 16 , wherein the cyber incidents include any one of:

threat detection, security incidents, compliance, user activity monitoring, network traffic analysis, and vulnerability management.

18 . The system of claim 15 , wherein the one or more processors are further configured to:

correlate the retrieved results to remove duplicated entries.

19 . The system of claim 18 , wherein the normalized format is an Open cybersecurity schema framework (OCSF).

20 . The system of claim 18 , wherein mapping sources in each CDS to an intermediate view, sources include any one of:

formats, tables, data locations, schemas, and the like.

21 . The system of claim 18 , wherein the one or more processors are further configured to:

generate the cyber-incident view using at least a retrieval-augmented generation (RAG) process.

22 . The system of claim 21 , wherein the one or more processors are further configured to:

tune, using an AI model, an output of the RAG process to detect inaccuracy in cyber-incident views generated using the RAG process.

23 . The system of claim 15 , wherein the one or more processors, when querying each of the plurality of target CDSs, are configured to:

for each of the plurality of target CDSs,

generate the respective native query complaint with a respective target CDS; and

query the respective target CDS with the respective native query.

24 . The system of claim 23 , wherein generating the respective native query includes converting the input query to the respective native query compliant with specifications of respective target CDS.

25 . The system of claim 23 , wherein the respective native query includes an API request.

26 . The system of claim 23 , wherein the input query is any one of an SQL query or a natural language query.

27 . The system of claim 23 , wherein the one or more processors, when determining at least one matching cyber-incident view, are configured to:

analyze the input query to determine the user intent for the requested results for the incident to be investigated; and

identify a cyber-incident matching the user's purpose for the requested results.