Natural language interface for querying cloud security logs

A system comprising:

• a processing device, and
• a memory device configured to store a computer program having instructions that, when executed, enable the processing device to
• receive a search request from an authorized user associated with an enterprise, wherein the search request includes natural language and is received via a query input element of a User Interface (UI),
• parse the search request by applying a generative Artificial Intelligence (AD) model in combination with a rule-based deterministic engine, including mapping the search request to enterprise-specific identifiers stored as embeddings in a vector database, to convert the natural language into one or more search parameters and a display format,
• retrieve log data from a secure private database associated with the enterprise, wherein the secure private database is hosted within a zero-trust security cloud and restricted from external access, wherein the log data is retrieved in accordance with the one or more search parameters and is related to network activities associated with the enterprise, and
• display the log data on the UI in accordance with the display format, including a Filters Applied section configured to present the search parameters and receive feedback for modification.

A method comprising the steps of:

• receiving a search request from an authorized user associated with an enterprise, wherein the search request includes natural language and is received via a query input element of a User Interface (UI);
• parsing the search request using a generative Artificial Intelligence (AI) model in combination with a rule-based deterministic filter and mapping the natural language to enterprise-specific identifiers using a vector database of embeddings, to convert the natural language into one or more search parameters and a display format;
• retrieving log data from a secure private database associated with the enterprise, wherein the log data is retrieved in accordance with the one or more search parameters and is related to network activities associated with the enterprise, wherein the secure private database is maintained in a zero-trust cloud security service, restricted to authorized enterprise users, and stores transaction records in compressed sparse form;
• and
• displaying the log data on the UI in accordance with the display format, including displaying a Filters Applied list showing the search parameters automatically derived from the natural language request.