Cybersecurity incident response techniques utilizing artificial intelligence

A non-transitory computer-readable medium storing a set of instructions for providing cybersecurity incident response, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the device to:
• provide a received incident input into a large language model (LLM);
• map the received incident input into a scenario of a plurality of scenarios, each scenario including a plurality of sub-scenarios, based on an output of the LLM;
• receive a user input through a user interface;
• the user interface configured to render a graphical representation of a group of sub-scenarios of the plurality of sub-scenarios;
• selecting a sub-scenario based on the received user input;
• generate a query based on the received incident input and a selection of a sub-scenario of the plurality of sub-scenarios;
• execute the query on a security database, the security database including a representation of a computing environment;
• and
• initiate a mitigation action based on a result of the executed query.

A system for providing cybersecurity incident response comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• provide a received incident input into a large language model (LLM);
• map the received incident input into a scenario of a plurality of scenarios, each scenario including a plurality of sub-scenarios, based on an output of the LLM;
• receive a user input through a user interface;
• the user interface configured to render a graphical representation of a group of sub-scenarios of the plurality of sub-scenarios;
• selecting a sub-scenario based on the received user input;
• generate a query based on the received incident input and a selection of a sub-scenario of the plurality of sub-scenarios;
• execute the query on a security database, the security database including a representation of a computing environment;
• and
• initiate a mitigation action based on a result of the executed query.