Cybersecurity incident response techniques utilizing artificial intelligence

1. A method for providing cybersecurity incident response, comprising:

receiving an incident input based on an event in a computing environment;

generating a prompt for a large language model (LLM) based on the received incident input;

utilizing the LLM to generate an output based on the generated prompt;

utilizing the LLM to map the received incident input into a scenario of a plurality of scenarios based on the output of the LLM, wherein each scenario is associated with an incidence response;

generating a query based on the received incident input and the mapped scenario;

executing the query on a security database, the security database including a representation of the computing environment; and

initiating a mitigation action based on a result of the executed query.

2. The method of claim 1 , further comprising:

detecting an identifier of a resource in the result of the executed query; and

initiating the mitigation action on the resource.

3. The method of claim 1 , further comprising:

detecting an identifier of a cybersecurity threat in the result of the executed query, the cybersecurity threat represented by a representation in the security database; and

detecting in the security database a representation of a remediation action connected to the representation of the cybersecurity threat.

4. The method of claim 3 , further comprising:

initiating the remediation action in the computing environment.

5. The method of claim 1 , wherein the mitigation action includes any one of: generating a notification, generating an alert, updating an alert, generating a severity score, updating a severity score, generating a ticket, generating a risk score, updating a risk score, initiating a remediation action, initiating an incident response, and any combination thereof.

6. The method of claim 1 , wherein the incident input includes any one of: a query, a statement, and a combination thereof.

7. The method of claim 1 , further comprising:

training the LLM on any one of: a data schema utilized in representing the computing environment, an incident data classified to a scenario, the plurality of scenarios, and any combination thereof.

8. The method of claim 7 , wherein generating the query further comprises:

generating a second prompt based on any one of: the received incident input, the data schema, the plurality of scenarios, and a combination thereof; and

utilizing the LLM with the second prompt to output the query.

9. The method of claim 7 , further comprising:

training the LLM further on a plurality of database queries, each database query executable on the security database.

10. A non-transitory computer-readable medium storing a set of instructions for providing cybersecurity incident response, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

receive an incident input based on an event in a computing environment;

generate a prompt for a large language model (LLM) based on the received incident input;

utilize the LLM to generate an output based on the generated prompt;

utilize the LLM to map the received incident input into a scenario of a plurality of scenarios based on the output of the LLM, wherein each scenario is associated with an incidence response;

generate a query based on the received incident input and the mapped scenario;

execute the query on a security database, the security database including a representation of the computing environment; and

initiate a mitigation action based on a result of the executed query.

11. A system for providing cybersecurity incident response comprising:

a processing circuitry;

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

receive an incident input based on an event in a computing environment;

generate a prompt for a large language model (LLM) based on the received incident input;

utilize the LLM to generate an output based on the generated prompt;

utilize the LLM to map the received incident input into a scenario of a plurality of scenarios based on the output of the LLM, wherein each scenario is associated with an incidence response;

generate a query based on the received incident input and the mapped scenario;

execute the query on a security database, the security database including a representation of the computing environment; and

initiate a mitigation action based on a result of the executed query.

12. The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect an identifier of a resource in the result of the executed query; and

initiate the mitigation action on the resource.

13. The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect an identifier of a cybersecurity threat in the result of the executed query, the cybersecurity threat represented by a representation in the security database; and

detect in the security database a representation of a remediation action connected to the representation of the cybersecurity threat.

14. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate the remediation action in the computing environment.

15. The system of claim 11 , wherein the mitigation action includes any one of:

generating a notification, generating an alert, updating an alert, generating a severity score, updating a severity score, generating a ticket, generating a risk score, updating a risk score, initiating a remediation action, initiating an incident response, and any combination thereof.

16. The system of claim 11 , wherein the incident input includes any one of:

a query, a statement, and a combination thereof.

17. The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

train the LLM on any one of:

a data schema utilized in representing the computing environment, an incident data classified to a scenario, the plurality of scenarios, and any combination thereof.

18. The system of claim 17 , wherein the memory contains further instructions that, when executed by the processing circuitry for generating the query, further configure the system to:

generate a second prompt based on any one of:

the received incident input, the data schema, the plurality of scenarios, and a combination thereof; and

utilize the LLM with the second prompt to output the query.

19. The system of claim 17 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

train the LLM further on a plurality of database queries, each database query executable on the security database.