Autonomous threat investigation

A method for autonomously investigating a potential cyber security threat, the method comprising:

• preparing and transmitting a language model prompt that includes:
• known threat event information pertaining to the potential cyber security threat;
• a function list describing functions that execute different types of investigative operations;
• and
• instructions directing a language model to return a first output identifying a next investigative action that the language model selects as appropriate to advance based on the known threat event information and the function list;
• discovering additional threat event information by executing the next investigative action;
• updating the known threat event information to include the additional threat event information;
• and
• subsequent to and based on the updating of the known threat event information, repeating the method to instruct the language model to identify another instance of the next investigative action;
• and
• generating and transmitting a report summarizing investigative findings in response to receiving a second output indicating that the next investigative action could not be identified by the language model.

A tangible processor-readable storage media encoding instructions for executing a process for autonomously investigating a potential cyber security threat, the process comprising:

• generating an event vector encoding known threat event information pertaining to the potential cyber security threat;
• extracting contextually-relevant investigation guidance from a database based on a comparison between the event vector and vectorized representations of portions of threat investigation reference materials;
• preparing and transmitting language model inputs that include:
• the known threat event information;
• the contextually-relevant investigation guidance;
• a function list describing functions that execute different types of investigative operations;
• and
• instructions directing a language model to return an output identifying a next investigative action is selected as appropriate to advance based on the known threat event information, the contextually-relevant investigation guidance, and the function list;
• discovering additional threat event information by executing the next investigative action in response to receiving the output from the language model;
• updating the known threat event information to include the additional threat event information;
• and
• subsequent to and based on updating of the known threat event information, repeating the process to autonomously identify and execute another instance of the next investigative action.