LLM-generated anomaly and security threat summaries

1 . A non-transitory computer-readable data storage medium storing program code executable by a processor to perform processing comprising:

selecting first anomalies from a plurality of anomalies identified by security analysis performed on a plurality of raw events regarding a plurality of entities;

enhancing the first anomalies with additional information;

selecting, from the plurality of anomalies, second anomalies regarding a specified entity of the plurality of entities which occurred within a specific time period, the second anomalies including at least one of the first anomalies;

generating a second prompt to input to a second large language model (LLM), the second prompt generated based on the second anomalies and based on the additional information with which the at least one of the first anomalies have been enhanced, the second prompt generated to solicit a second response including a natural language summary synthesizing the second anomalies;

providing the second prompt as input to the second LLM, and receiving the second response as output from the second LLM;

evaluating the second anomalies against a security threats database to identify security threats that the second anomalies are related to;

respectively generating scores for the identified security threats that the second anomalies are related to;

selecting a subset of the identified security threats that the second anomalies are related to, based on the scores;

generating a third prompt to input to a third LLM, the third prompt generated based on the selected subset of the identified security threats and based on the second response, the third prompt generated to solicit a third response including a natural language summary associating the identified security threats with the second anomalies;

providing the third prompt as input to the third LLM, and receiving the third response as output from the third LLM; and

performing an action related to the identified security threats based on the second and third responses.

2 . The non-transitory computer-readable data storage medium of claim 1 , wherein performing the action comprises outputting the natural language summary of each of the second and third responses.

3 . The non-transitory computer-readable data storage medium of claim 1 , wherein performing the action comprises resolving or limiting an impact of at least the identified security threats at the specified entity.

4 . The non-transitory computer-readable data storage medium of claim 3 , wherein resolving or limiting the impact comprises either or both of:

reconfiguring the specified entity to resolve at least the identified security threats; and

quarantining the specified entity to limit the impact of at least the identified security threats.

5 . The non-transitory computer-readable data storage medium of claim 1 , wherein the processing further comprises:

generating, based on the first anomalies as have been enriched with the additional information, a first prompt to input to a first LLM, the first prompt generated to solicit a first response including a natural language summary of the first anomalies; and

providing the first prompt as input to the first LLM, and receiving the first response as output from the first LLM.

6 . The non-transitory computer-readable data storage medium of claim 5 , wherein performing the action comprises outputting the natural language summary of each of the first, second, and third responses.

7 . The non-transitory computer-readable data storage medium of claim 5 , wherein performing the action comprises resolving or limiting an impact of at least one of the first anomalies, the second anomalies, and the identified security threats.

8 . The non-transitory computer-readable data storage medium of claim 5 , wherein at least two of the first, second, and third LLMs are a same LLM, or each of the first, second and third LLMs is a different LLM.

9 . The non-transitory computer-readable data storage medium of claim 1 , wherein enhancing the first anomalies with the additional information comprises:

retrieving the raw events related to the first anomalies and on which basis the security analysis identified the first anomalies; and

including the retrieved raw events within the additional information regarding the first anomalies.

10 . The non-transitory computer-readable data storage medium of claim 1 , wherein the first anomalies that have been identified by the security analysis include process anomalies that each specify a process that has been executing on a corresponding entity.

11 . The non-transitory computer-readable data storage medium of claim 10 , wherein enhancing the first anomalies with the additional information comprises, for the process specified by each process anomaly:

calling an application programming interface (API) for a knowledge base of the security threats to retrieve information regarding the security threats that the process is related to, based on a hash of the process; and

including the retrieved information regarding the security threats that the process is related to within the additional information.

12 . The non-transitory computer-readable data storage medium of claim 10 , wherein enhancing the first anomalies with the additional information comprises, for the process specified by each process anomaly:

retrieving information regarding one or more than one of:

a process hierarchy of the process, including either or both of a parent process and a grandparent process of the process that have also been executing on the specified entity;

an importance level of the process;

a description of the process; a command-line instruction used to invoke the process;

an amount of time that the process has been executing on the specified entity; and

an amount of time that the process has been executing on an entity group including the specified entity; and

including the retrieved information within the additional information.

13 . The non-transitory computer-readable data storage medium of claim 10 , wherein respectively generating the scores for the identified security threats that the second anomalies are related to comprises, for each identified security threat:

generating a score for the identified security threat using a function based on:

a total number of the second anomalies that are related to the identified security threat; and

a total number of the process anomalies included in the second anomalies that are related to the identified security threat.

14 . The non-transitory computer-readable data storage medium of claim 1 , wherein evaluating the second anomalies against the security threats database comprises, for each second anomaly:

generating an embedding vector capturing a semantic representation of the second anomaly;

querying the security threats database using the embedding vector to identify, as the security threats that the second anomaly is related to, a number of the security threats satisfying a matching criterion; and

receiving, when querying the security threats database using the embedding vector, a semantic-matching distance between the embedding vector and each of the number of the security threats satisfying the matching criterion.

15 . The non-transitory computer-readable data storage medium of claim 14 , wherein the security threats database is an embedding vector database of embedding vectors for the security threats,

wherein the embedding vector for each security threat captures a semantic representation of information regarding the security threat within a knowledge base of the security threats,

wherein generating the embedding vector for each second anomaly comprises applying a specified embedding model to the second anomaly,

and wherein the embedding vector for each security threat is generated by applying the specified embedding model to the information regarding the security threat within the knowledge base.

16 . A method performed by a computing device and comprising:

selecting first anomalies from a plurality of anomalies identified by security analysis performed on a plurality of raw events regarding a plurality of entities;

enhancing the first anomalies with additional information;

generating, based on the first anomalies as have been enriched with the additional information, a first prompt to input to a first large-language model (LLM), the first prompt generated to solicit a first response including a natural language summary of the first anomalies; and

providing the first prompt as input to the first LLM, and receiving the first response as output from the first LLM;

selecting, from the plurality of anomalies, second anomalies regarding a specified entity of the plurality of entities which occurred within a specific time period, the second anomalies including at least one of the first anomalies;

generating a second prompt to input to a second LLM, the second prompt generated based on the second anomalies and based on the additional information with which the at least one of the first anomalies have been enhanced, the second prompt generated to solicit a second response including a natural language summary synthesizing the second anomalies;

providing the second prompt as input to the second LLM, and receiving the second response as output from the second LLM;

evaluating the second anomalies against a security threats database to identify security threats that the second anomalies are related to;

respectively generating scores for the identified security threats that the second anomalies are related to;

selecting a subset of the identified security threats that the second anomalies are related to, based on the scores;

generating a third prompt to input to a third LLM, the third prompt generated based on the selected subset of the identified security threats and based on the second response, the third prompt generated to solicit a third response including a natural language summary associating the identified security threats with the second anomalies;

providing the third prompt as input to the third LLM, and receiving the third response as output from the third LLM; and

performing an action based on the first, second, and third responses.

17 . The method of claim 16 , wherein performing the action comprises outputting the natural language summary of each of the first, second, and third responses.

18 . The method of claim 16 , wherein performing the action comprises resolving or limiting an impact of at least one of the first anomalies, the second anomalies, and the identified security threats.

19 . The method of claim 18 , wherein resolving or limiting the impact comprises either or both of:

reconfiguring the specified entity to resolve at least one of the first anomalies, the second anomalies, and the identified security threats; and

quarantining the specified entity to limit the impact of at least one of the first anomalies, the second anomalies, and the identified security threats.

20 . A computing system comprising:

a non-transitory computer-readable data storage medium storing program code; and

a processor configured to execute the program code to perform a processing comprising:

selecting first anomalies from a plurality of anomalies identified by security analysis performed on a plurality of raw events regarding a plurality of entities;

enhancing the first anomalies with additional information;

generating, based on the first anomalies as have been enriched with the additional information, a first prompt to input to a first large-language model (LLM), the first prompt generated to solicit a first response including a natural language summary of the first anomalies; and

providing the first prompt as input to the first LLM, and receiving the first response as output from the first LLM;

selecting, from the plurality of anomalies, second anomalies regarding a specified entity of the plurality of entities which occurred within a specific time period, the second anomalies including at least one of the first anomalies;

generating a second prompt to input to a second LLM, the second prompt generated based on the second anomalies and based on the additional information with which the at least one of the first anomalies have been enhanced, the second prompt generated to solicit a second response including a natural language summary synthesizing the second anomalies;

providing the second prompt as input to the second LLM, and receiving the second response as output from the second LLM;

evaluating the second anomalies against a security threats database to identify security threats that the second anomalies are related to;

respectively generating scores for the identified security threats that the second anomalies are related to;

selecting a subset of the identified security threats that the second anomalies are related to, based on the scores;

generating a third prompt to input to a third LLM, the third prompt generated based on the selected subset of the identified security threats and based on the second response, the third prompt generated to solicit a third response including a natural language summary associating the identified security threats with the second anomalies;

providing the third prompt as input to the third LLM, and receiving the third response as output from the third LLM; and

performing an action based on the first, second, and third responses to resolve or limit an impact of at least one of the first anomalies, the second anomalies, and the identified security threats.