Security analysis agents

A network computer, comprising:

• a memory that stores instructions for monitoring events in a computing environment;
• one or more processors that execute the instructions to cause actions, including:
• obtaining a prompt having one or more fragments based on one or more events and a local requirement to customize information for a prompt template and historical information that are used to train one or more large language models (LLMs) to support the local requirement;
• and
• employing the one or more trained LLMs to perform actions, including:
• obtaining an evaluation of an association of the one or more prompt fragments with the one or more events based on one or more of a resource or an activity;
• using one or more synthetic events associated with one or more predicted classifications to modify the one or more prompt fragments or the prompt for use in retraining the one or more LLMs;
• and
• obtaining another evaluation for one or more other events based on the one or more retrained LLMs.

A processor readable non-transitory storage media that includes instructions for monitoring events in a computing environment, wherein execution of the instructions by one or more processors on one or more network computers causes performance of actions, comprising:

• obtaining a prompt having one or more fragments based on one or more events and a local requirement to customize information for a prompt template and historical information that are used to train one or more large language models (LLMs) to support the local requirement;
• and
• employing the one or more trained LLMs to perform actions, including:
• obtaining an evaluation of an association of the one or more prompt fragments with the one or more events based on one or more of a resource or an activity;
• using one or more synthetic events associated with one or more predicted classifications to modify the one or more prompt fragments or the prompt for use in retraining the one or more LLMs;
• and
• obtaining another evaluation for one or more other events based on the one or more retrained LLMs.