Method and system for constructing vector databases used for converting free text queries to cyber language queries

A non-transitory computer-readable medium storing a set of instructions for querying data sources for cybersecurity analysis, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the device to:
• one or more instructions that, when executed by one or more processing circuitries of a device, cause the device to:
• identify fields that are relevant to an input natural language query (NLQ), computing values for the identified fields based on actual values that are relevant to the identified fields and the NLQ;
• generate, based on at least a refined schema, a prompt for a language model, wherein the language model is executed by an AI-based query generation system;
• and
• feed the prompt to the language model, wherein the language model, executes the prompt using the AI-based query generation system, to convert the NLQ into a cyber language query;
• and
• execute the cyber language query on a plurality of data sources to perform cybersecurity analysis on security logs logged in the security logs.

A system for querying data sources for cybersecurity analysis comprising:

• one or more processors configured to:
• a processing circuitry;
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• identify fields that are relevant to an input natural language query (NLQ), computing values for the identified fields based on actual values that are relevant to the identified fields and the NLQ;
• generate, based on at least a refined schema, a prompt for a language model, wherein the language model is executed by an AI-based query generation system;
• and
• feed the prompt to the language model, wherein the language model, executes the prompt using the AI-based query generation system, to convert the NLQ into a cyber language query;
• and
• execute the cyber language query on a plurality of data sources to perform cybersecurity analysis on security logs logged in the security logs.