De-coupled security information and event management system, and method thereof

A non-transitory computer-readable medium storing a set of instructions for a federated search across multiple different SIEM tools connected to a plurality of target data sources, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the device to:
• receive an input query at a SIEM federated search engine wherein the input user query is either in a format of an SQL query or a natural language query wherein input query is entered by a user attempting to retrieve information from multiple SIEM tools;
• determine, using plurality of potential cyber incident views, target Cyber Data Sources (CDS's) from the plurality of target data sources to query;
• determine, using a large language model (LLM), at least one matching cyber-incident view from the plurality of potential cyber incident views to serve an input query, when at least one matching cyber-incident view lists a plurality of target cyber data sources (CDSs), and wherein the matching cyber-incident view is determined based on an incident that a user intends to investigate based on the plurality of potential cyber incident views, wherein the cyber-incident view includes an intermediate view and a normalized view;
• query each of the plurality of target CDSs, wherein each of the plurality of target CDSs is quired with a respective native query, wherein the respective native query corresponds to the input query;
• retrieve results from the plurality of target CDSs in response to the respective native query;
• normalize retrieved results based on the matching cyber-incident view, wherein normalized results displayed all the retrieved results in a consistent manner, wherein the one or more processors, when normalizing the retrieved results, are configured to:
• map the retrieved results to an intermediate format using the intermediate view;
• and
• map the retrieved results from the intermediate format to a normalized format using the normalized view;
• and
• display the normalized results in response to the input query.

A system for a federated search across multiple different SIEM tools connected to a plurality of target data sources, comprising:

• one or more processors configured to:
• receive an input query at a SIEM federated search engine wherein the input user query is either in a format of an SQL query or a natural language query wherein input query is entered by a user attempting to retrieve information from multiple SIEM tools;
• determine, using plurality of potential cyber incident views, target Cyber Data Sources (CDS's) from the plurality of target data sources to query;
• determine, using a large language model (LLM), at least one matching cyber-incident view from the plurality of potential cyber incident views to serve an input query, when at least one matching cyber-incident view lists a plurality of target cyber data sources (CDSs), and wherein the matching cyber-incident view is determined based on an incident that a user intends to investigate based on the plurality of potential cyber incident views, wherein the cyber-incident view includes an intermediate view and a normalized view;
• query each of the plurality of target CDSs, wherein each of the plurality of target CDSs is quired with a respective native query, wherein the respective native query corresponds to the input query;
• retrieve results from the plurality of target CDSs in response to the respective native query,
• normalize retrieved results based on the matching cyber-incident view, wherein normalized results displayed all the retrieved results in a consistent manner, wherein the one or more processors, when normalizing the retrieved results, are configured to:
• map the retrieved results to an intermediate format using the intermediate view;
• and
• map the retrieved results from the intermediate format to a normalized format using the normalized view;
• and
• display the normalized results in response to the input query.