# US 12,001,550 B1 · Cybersecurity incident response techniques utilizing artificial intelligence

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,001,550 B1
- Document ID: US12001550B1
- Status: Granted
- Kind: B1
- Application number: 18/466,882
- Filed: 2023-09-14
- Granted: 2024-06-04
- Earliest claimed: 2023-08-28
- Assignees: Wiz, Inc.
- Applicants: Wiz, Inc.
- Inventors: Alon Schindel; Barak Sharoni; Amitai Cohen; Ami Luttwak; Roy Reznik; Yinon Costica
- Web page: https://patentgrep.com/patent/US12001550B1

## CPC

- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 16/24522: {Translation of natural language queries to structured queries}
- G06F 21/554: {involving event detection and direct action}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system and method for providing cybersecurity incident response utilizing a large language model. The method includes: mapping a received incident input into a scenario of a plurality of scenarios, each scenario including a plurality of sub-scenarios; generating a query based on the received incident input and a selection of a sub-scenario of the plurality of sub-scenarios; executing the query on a security database, the security database including a representation of the computing environment; and initiating a mitigation action based on a result of the executed query.

## Claims

### Claim 1

A method for providing cybersecurity incident response, comprising:
providing a received incident input into a large language model (LLM);
mapping the received incident input into a scenario of a plurality of scenarios, each scenario including a plurality of sub-scenarios, based on an output of the LLM;
receiving a user input through a user interface, the user interface configured to render a graphical representation of a group of sub-scenarios of the plurality of sub-scenarios;
selecting a sub-scenario based on the received user input;
generating a query based on the received incident input and a selection of a sub-scenario of the plurality of sub-scenarios;
executing the query on a security database, the security database including a representation of a computing environment; and
initiating a mitigation action based on a result of the executed query.

### Claim 2 (depends on 1)

The method of claim 1, wherein the incident input includes any one of: a query, a statement, and a combination thereof.

### Claim 3 (depends on 1)

The method of claim 1, wherein the LLM is trained on: a data schema utilized in representing the computing environment, incident data classified to a scenario, the plurality of scenarios, and any combination thereof.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
generating the query further using the LLM.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
training the LLM on a plurality of database queries, each database query executable on the security database.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
generating a prompt for the LLM based on the received user input, the prompt, when executed configuring the LLM to output a sub-scenario selection.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
receiving a user input through a component of a graphical user interface to initiate generation of an explanation of a security finding;
utilizing the LLM to generate an explanation of a security finding, the explanation including any one of: a base observation regarding the security finding, an analysis of a symptomatic nature of the security finding, and a combination thereof; and
rendering for display the generated explanation of the security finding.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
processing a user input through a component of a graphical user interface to initiate investigation of a custom incident; and
generating a request to receive additional contextual information wherein the custom incident is unrelated to any specific resource.

### Claim 9

A non-transitory computer-readable medium storing a set of instructions for providing cybersecurity incident response, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
provide a received incident input into a large language model (LLM);
map the received incident input into a scenario of a plurality of scenarios, each scenario including a plurality of sub-scenarios, based on an output of the LLM;
receive a user input through a user interface; the user interface configured to render a graphical representation of a group of sub-scenarios of the plurality of sub-scenarios;
selecting a sub-scenario based on the received user input;
generate a query based on the received incident input and a selection of a sub-scenario of the plurality of sub-scenarios;
execute the query on a security database, the security database including a representation of a computing environment; and
initiate a mitigation action based on a result of the executed query.

### Claim 10

A system for providing cybersecurity incident response comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
provide a received incident input into a large language model (LLM);
map the received incident input into a scenario of a plurality of scenarios, each scenario including a plurality of sub-scenarios, based on an output of the LLM;
receive a user input through a user interface; the user interface configured to render a graphical representation of a group of sub-scenarios of the plurality of sub-scenarios;
selecting a sub-scenario based on the received user input;
generate a query based on the received incident input and a selection of a sub-scenario of the plurality of sub-scenarios;
execute the query on a security database, the security database including a representation of a computing environment; and
initiate a mitigation action based on a result of the executed query.

### Claim 11 (depends on 10)

The system of claim 10, wherein the incident input includes any one of:
a query, a statement, and a combination thereof.

### Claim 12 (depends on 10)

The system of claim 10, wherein the LLM is trained on:
a data schema utilized in representing the computing environment, incident data classified to a scenario, the plurality of scenarios, and any combination thereof.

### Claim 13 (depends on 10)

The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate the query further using the LLM.

### Claim 14 (depends on 10)

The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
train the LLM on a plurality of database queries, each database query executable on the security database.

### Claim 15 (depends on 10)

The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate a prompt for the LLM based on the received user input, the prompt, when executed configuring the LLM to output a sub-scenario selection.

### Claim 16 (depends on 10)

The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
receive a user input through a component of a graphical user interface to initiate generation of an explanation of a security finding;
utilize the LLM to generate an explanation of a security finding, the explanation including any one of:
a base observation regard the security finding, an analysis of a symptomatic nature of the security finding, and a combination thereof; and
render for display the generated explanation of the security finding.

### Claim 17 (depends on 10)

The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
process a user input through a component of a graphical user interface to initiate investigation of a custom incident; and
generate a request to receive additional contextual information wherein the custom incident is unrelated to any specific resource.