# US 12,001,549 B1 · Cybersecurity incident response techniques utilizing artificial intelligence

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,001,549 B1
- Document ID: US12001549B1
- Status: Granted
- Kind: B1
- Application number: 18/428,794
- Filed: 2024-01-31
- Granted: 2024-06-04
- Earliest claimed: 2023-08-28
- Assignees: Wiz, Inc.
- Applicants: Wiz, Inc.
- Inventors: Alon Schindel; Barak Sharoni; Amitai Cohen; Ami Luttwak; Roy Reznik; Yinon Costica
- Web page: https://patentgrep.com/patent/US12001549B1

## CPC

- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 16/24522: {Translation of natural language queries to structured queries}
- G06F 21/554: {involving event detection and direct action}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system and method for providing cybersecurity incident response utilizing a large language model. The method includes: mapping a received incident input into a scenario of a plurality of scenarios, each scenario including a plurality of sub-scenarios; generating a query based on the received incident input and a selection of a sub-scenario of the plurality of sub-scenarios; executing the query on a security database, the security database including a representation of the computing environment; and initiating a mitigation action based on a result of the executed query.

## Claims

### Claim 1

A method for providing cybersecurity incident response, comprising:
receiving an incident input based on a cybersecurity event;
generating a prompt for a large language model (LLM) based on the received incident input;
configuring the LLM to generate an output based on the generated prompt;
mapping the received incident input into a scenario of a plurality of scenarios based on the output of the LLM, wherein each scenario is associated with an incidence response;
generating a query based on the received incident input and the mapped scenario;
executing the query on a security database, the security database including a representation of a computing environment; and
initiating a mitigation action based on a result of the executed query.

### Claim 2 (depends on 1)

The method of claim 1, wherein the incident input includes any one of: a query, a statement, and a combination thereof.

### Claim 3 (depends on 1)

The method of claim 1, wherein the LLM is trained on any one of: a data schema utilized in representing the computing environment, incident data classified to a scenario, the plurality of scenarios, and a combination thereof.

### Claim 4 (depends on 3)

The method of claim 3, wherein generating the query further comprises:
generating a second prompt for the LLM which when executed by the LLM outputs the query, wherein the second prompt is generated based on any one of: the received incident input, the data schema, the plurality of scenarios, and a combination thereof.

### Claim 5 (depends on 3)

The method of claim 3, further comprising:
training the LLM further on a plurality of database queries, each database query executable on the security database.

### Claim 6 (depends on 3)

The method of claim 3, further comprising:
receiving a user input through a user interface, the user interface configured to render a graphical representation of the plurality of scenarios;
selecting a sub-scenario of a scenario of the plurality of scenarios based on the received user input.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
generating a prompt for the LLM based on the received user input, the prompt, when executed configuring the LLM to output a sub-scenario selection.

### Claim 8 (depends on 7)

The method of claim 7, further comprising:
processing a user input through a component of a graphical user interface to initiate investigation of a custom incident; and
generating a request to receive additional contextual information wherein the custom incident is unrelated to any specific resource.

### Claim 9 (depends on 6)

The method of claim 6, further comprising:
traversing the security database to detect a cybersecurity finding, the finding associated with a resource, the resource associated with an incident of the incident response.

### Claim 10 (depends on 9)

The method of claim 9, further comprising:
receiving a user input through a component of a graphical user interface to initiate generation of an explanation of the security finding;
utilizing the LLM to generate an explanation of the security finding, the explanation including any one of: a base observation regarding the security finding, an analysis of a symptomatic nature of the security finding, and a combination thereof; and
rendering for display the generated explanation of the security finding.

### Claim 11

A non-transitory computer-readable medium storing a set of instructions for providing cybersecurity incident response, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
receive an incident input based on a cybersecurity event;
generate a prompt for a large language model (LLM) based on the received incident input;
configure the LLM to generate an output based on the generated prompt;
map the received incident input into a scenario of a plurality of scenarios based on the output of the LLM, wherein each scenario is associated with an incidence response;
generate a query based on the received incident input and the mapped scenario;
execute the query on a security database, the security database including a representation of a computing environment; and
initiate a mitigation action based on a result of the executed query.

### Claim 12

A system for providing cybersecurity incident response comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
receive an incident input based on a cybersecurity event;
generate a prompt for a large language model (LLM) based on the received incident input;
configure the LLM to generate an output based on the generated prompt;
map the received incident input into a scenario of a plurality of scenarios based on the output of the LLM, wherein each scenario is associated with an incidence response;
generate a query based on the received incident input and the mapped scenario;
execute the query on a security database, the security database including a representation of a computing environment; and
initiate a mitigation action based on a result of the executed query.

### Claim 13 (depends on 12)

The system of claim 12, wherein the incident input includes any one of:
a query, a statement, and a combination thereof.

### Claim 14 (depends on 12)

The system of claim 12, wherein the LLM is trained on any one of:
a data schema utilized in representing the computing environment, incident data classified to a scenario, the plurality of scenarios, and a combination thereof.

### Claim 15 (depends on 14)

The system of claim 14, wherein the memory contains further instructions that, when executed by the processing circuitry for generating the query, further configure the system to:
generate a second prompt for the LLM which when executed by the LLM outputs the query, wherein the second prompt is generated based on any one of:
the received incident input, the data schema, the plurality of scenarios, and a combination thereof.

### Claim 16 (depends on 14)

The system of claim 14, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
train the LLM further on a plurality of database queries, each database query executable on the security database.

### Claim 17 (depends on 14)

The system of claim 14, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
receive a user input through a user interface, the user interface configured to render a graphical representation of the plurality of scenarios; and
select a sub-scenario of a scenario of the plurality of scenarios based on the received user input.

### Claim 18 (depends on 17)

The system of claim 17, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate a prompt for the LLM based on the received user input, the prompt, when executed configuring the LLM to output a sub-scenario selection.

### Claim 19 (depends on 18)

The system of claim 18, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
process a user input through a component of a graphical user interface to initiate investigation of a custom incident; and
generate a request to receive additional contextual information wherein the custom incident is unrelated to any specific resource.

### Claim 20 (depends on 17)

The system of claim 17, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
traverse the security database to detect a cybersecurity finding, the finding associated with a resource, the resource associated with an incident of the incident response.

### Claim 21 (depends on 20)

The system of claim 20, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
receive a user input through a component of a graphical user interface to initiate generation of an explanation of the security finding;
utilize the LLM to generate an explanation of the security finding, the explanation including any one of:
a base observation regard the security finding, an analysis of a symptomatic nature of the security finding, and a combination thereof; and
render for display the generated explanation of the security finding.