TECHNOLOGIES FOR AUTOMATED PREDICTIVE CURATION OF CONTEXTUALIZATION STEPS FOR INVESTIGATING A SECURITY INCIDENT

1 . A computing device for security incident analysis with adaptive incident clustering, the computing device comprising:

an incident clustering engine to cluster a plurality of security incidents and runbooks into a plurality of clusters based on investigation similarity associated with the plurality of security incidents and the runbooks;

a cluster criteria manager to determine one or more criteria for inclusion of a security incident in each cluster of the plurality of clusters, wherein each of the one or more criteria comprises explainable logic for assignment of security incidents to the associated cluster;

a retrieval augmented generation pipeline to access one or more retrieval sources for contextual awareness; and

an investigation step engine to determine a suggested investigation step for each cluster of the plurality of clusters with the retrieval augmented generation pipeline, wherein each suggested investigation step comprises a natural language description and a programmatic query of a security incident data store.

2 . The computing device of claim 1 , wherein each security incident of the plurality of security incidents comprises a record including a plurality of fields that are indicative of a detected computer security incident or a detected network security incident characterized by anomaly detection thresholds.

3 . The computing device of claim 1 , further comprising a cluster summarizer to determine, with a large language model, a summary of each cluster in the plurality of clusters based on the security incidents of the cluster.

4 . The computing device of claim 1 , further comprising an investigation manager to:

receive a first security incident, wherein the security incident comprises a plurality of fields indicative of a potential security detection at a monitored computer system or network;

assign the first security incident to a first cluster of the plurality of clusters based on the one or more criteria for inclusion of the security incident in each cluster of the plurality of clusters; and

retrieve a first suggested investigation step for the first cluster, wherein the first suggested investigation step was determined by the retrieval augmented generation pipeline for the first cluster.

5 . The computing device of claim 4 , further comprising an investigation interface to present the first security incident and the first suggested investigation step to a first user.

6 . The computing device of claim 5 , wherein the investigation interface is further to receive a security incident resolution from the first user, the computing device further comprising a curation manager to perform reinforcement learning with human feedback based on the security incident resolution.

7 . The computing device of claim 1 , wherein investigation similarity comprises vector similarity metrics and semantic proximity.

8 . The computing device of claim 7 , wherein to cluster the plurality of security incidents and runbooks comprises to:

generate a vector embedding for each security incident of the plurality of security incidents and for each runbook;

identify the vector embedding associated with each runbook as a centroid of a corresponding cluster; and

compare the vector embedding associated with each security incident to each of the centroids to determine an associated investigation similarity.

9 . The computing device of claim 1 , wherein to cluster the plurality of security incidents and runbooks comprises to:

determine a natural language description of investigation steps for each security incident with a large language model;

generate an embedding for the natural language description of investigation steps for each security incident of the plurality of security incidents; and

determine investigation similarity based on the embedding associated with the natural language description of each security incident.

10 . The computing device of claim 1 , wherein to cluster the plurality of security incidents and runbooks comprises to:

determine a label for each security incident of the plurality of security incidents, wherein the label comprises a benign label or a malicious label;

train a plurality of classification models on the labels associated with each of the plurality of security incidents; and

determine investigation similarity based on similarity of classification model.

11 . The computing device of claim 1 , wherein to determine the one or more criteria for inclusion of a security incident in the cluster comprises to:

identify a high granularity field of the plurality of security incidents; and

match against values of the high granularity field for the plurality of security incidents in the cluster.

12 . The computing device of claim 1 , wherein to determine the one or more criteria for inclusion of a security incident in the cluster comprises to:

determine fields of the plurality of security incidents having a high divergence between first security incidents in the cluster and second security incidents outside of the cluster; and

match against values of the fields having the high divergence.

13 . The computing device of claim 1 , wherein to determine the one or more criteria for inclusion of a security incident in the cluster comprises to train a machine learning classifier to classify between first security incidents in the cluster and second security incidents outside of the cluster.

14 . The computing device of claim 1 , wherein to determine the suggested investigation step for the cluster with the retrieval augmented generation pipeline comprises to determine the programmatic query with a schema of the security incident data store as a retrieval source of the retrieval augmented generation pipeline.

15 . A method for security incident analysis with adaptive incident clustering, the method comprising:

clustering, by a computing device, a plurality of security incidents and runbooks into a plurality of clusters based on investigation similarity associated with the plurality of security incidents and the runbooks; and

for each cluster in the plurality of clusters:

determining, by the computing device, one or more criteria for inclusion of a security incident in the cluster, wherein each of the one or more criteria comprises explainable logic for assigning security incidents to the associated cluster;

accessing, by the computing device, one or more retrieval sources for contextual awareness with a retrieval augmented generation pipeline of the computing device; and

determining, by the computing device, a suggested investigation step for the cluster with the retrieval augmented generation pipeline, wherein the suggested investigation step comprises a natural language description and a programmatic query of a security incident data store.

16 . The method of claim 15 , further comprising, for each cluster in the plurality of clusters, determining, by the computing device with a large language model, a summary of the cluster based on the security incidents of the cluster.

17 . The method of claim 15 , further comprising:

receiving, by the computing device, a first security incident, wherein the security incident comprises a plurality of fields indicative of a potential security detection at a monitored computer system or network;

assigning, by the computing device, the first security incident to a first cluster of the plurality of clusters based on the one or more criteria for inclusion of the security incident in each cluster of the plurality of clusters; and

retrieving, by the computing device, a first suggested investigation step for the first cluster, wherein the first suggested investigation step was determined by the retrieval augmented generation pipeline for the first cluster.

18 . The method of claim 15 , wherein clustering the plurality of security incidents and runbooks comprises:

generating a vector embedding for each security incident of the plurality of security incidents and for each runbook;

identifying the vector embedding associated with each runbook as a centroid of a corresponding cluster; and

comparing the vector embedding associated with each security incident to each of the centroids to determine an associated investigation similarity.

19 . The method of claim 15 , wherein clustering the plurality of security incidents and runbooks comprises:

determining a natural language description of investigation steps for each security incident with a large language model;

generating an embedding for the natural language description of investigation steps for each security incident of the plurality of security incidents; and

determining investigation similarity based on the embedding associated with the natural language description of each security incident.

20 . The method of claim 15 , wherein clustering the plurality of security incidents and runbooks comprises:

determining a label for each security incident of the plurality of security incidents, wherein the label comprises a benign label or a malicious label;

training a plurality of classification models on the labels associated with each of the plurality of security incidents; and

determining investigation similarity based on similarity of classification model.