Granted Patent B2

US 12,608,370 · App. 18/651,037 · Granted Apr 21, 2026

Inventors: Alon Schindel (Tel Aviv, IL); Barak Sharoni (Tel Aviv, IL); Ami Luttwak (Binyamina, IL); Roy Reznik (Tel Aviv, IL); Yinon Costica (Tel Aviv, IL)

Assignee: Wiz, Inc.

G06F16/243G06F16/212G06F16/2455

Abstract

Claims (66)

1 . A method for generating a database query based on a natural language query, comprising:

receiving a query including a natural language query directed to a security database, wherein the security database includes a representation of a computing environment;

determining a data schema utilized to represent an entity of the computing environment in the security database;

generating a prompt for a large language model (LLM) based on: the received query, and the determined data schema;

generating a database query by processing the generated prompt; and

executing the database query on the security database.

2 . The method of claim 1 , further comprising:

selecting a preselected database query from a plurality of preselected database queries; and;

generating the prompt further based on the preselected database query.

3 . The method of claim 2 , further comprising:

determining a match between the natural language query and the preselected database query; and

determining a match between the natural language query and another preselected database query.

4 . The method of claim 3 , further comprising:

selecting the preselected database query or the another preselected database query based on the determined match.

5 . The method of claim 1 , further comprising:

determining the data schema based on the natural language query.

6 . The method of claim 1 , further comprising:

initiating inspection of another entity of the computing environment in response to a result of executing the database query on the security database.

7 . The method of claim 6 , further comprising:

initiating a mitigation action based on a result of the inspection of the another entity.

8 . The method of claim 6 , further comprising:

initiating, based on a result of the inspection, any one of: a remediation action, a forensic finding, a mitigation action, and a combination thereof.

9 . The method of claim 1 , further comprising:

parsing the received natural language query to a textual input including a plurality of text elements;

mapping a first text element of the plurality of text elements to a predetermined keyword; and

replacing the first text element with the predetermined keyword; and

tokenizing the received query including the predetermined keyword.

10 . A non-transitory computer-readable medium storing a set of instructions for generating a database query based on a natural language query, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

receive a query including a natural language query directed to a security database, wherein the security database includes a representation of a computing environment;

determine a data schema utilized to represent an entity of the computing environment in the security database;

generate a prompt for a large language model (LLM) based on:

the received query, and the determined data schema;

generate a database query by processing the generated prompt; and

execute the database query on the security database.

11 . A system for generating a database query based on a natural language query comprising:

a processing circuitry;

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

receive a query including a natural language query directed to a security database, wherein the security database includes a representation of a computing environment;

determine a data schema utilized to represent an entity of the computing environment in the security database;

generate a prompt for a large language model (LLM) based on:

the received query, and the determined data schema;

generate a database query by processing the generated prompt; and

execute the database query on the security database.

12 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

select a preselected database query from a plurality of preselected database queries; and

generate the prompt further based on the preselected database query.

13 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

determine a match between the natural language query and the preselected database query; and

determine a match between the natural language query and another preselected database query.

14 . The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

select the preselected database query or the another preselected database query based on the determined match.

15 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

determine the data schema based on the natural language query.

16 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate inspection of another entity of the computing environment in response to a result of executing the database query on the security database.

17 . The system of claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate a mitigation action based on a result of the inspection of the another entity.

18 . The system of claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate, based on a result of the inspection, any one of:

a remediation action, a forensic find, a mitigation action, and a combination thereof.

19 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

parse the received natural language query to a textual input including a plurality of text elements;

map a first text element of the plurality of text elements to a predetermined keyword; and

replace the first text element with the predetermined keyword; and

tokenize the received query including the predetermined keyword.

Continuity (2)

References Cited (134)