Abstract: A system having transceiver and processor is disclosed. The transceiver may receive an alert from a security tool associated with an organization. The processor may obtain the alert from the transceiver, and generate an interactive graph interface. The interactive graph interface includes a primary node corresponding to the alert, and a set of secondary nodes connected to the primary node. The set of secondary nodes may include a set of hypotheses node chains. Each hypotheses node chain includes a first level hypothesis node and a second level hypothesis node. Each hypothesis node represents a hypothesis, to be further investigated by a user, associated with the alert. The processor may render the interactive graph interface on a user interface, obtain a user input indicative of a selection of a first secondary node from the set of secondary nodes via the user interface, and perform an action based on the user input.

Abstract: A system to automate threat operations is disclosed. The system may include a processor and a memory. The processor may obtain an unstructured data from one or more external sources, and convert the unstructured data into a structured data by using a first Large Language Model (LLM). The processor may execute a threat hunt model to detect a threat to a computing infrastructure of an organization based on the structured data by using an agentic threat detection and response module. The agentic threat detection and response module includes one or more second LLMs. The processor may dynamically detect the threat based on the execution of the threat hunt model by using the agentic threat detection and response module, and automatically perform an action responsive to detecting the threat by using the agentic threat detection and response module.

Abstract: A system to verify correctness of content is disclosed. The system may include one or more processors and a memory. The processors may obtain, by a content generation LLM, a user prompt via a user interface rendered on a user device, and generate a response to the user prompt responsive to obtaining the user prompt. The content generation LLM may be paired with Retrieval Augmented Generation (RAG) sources. The processors may transmit, by the content generation LLM, the response to a verifier LLM. The processors may parse, by the verifier LLM, the response into structured data, and compare the structured data with data stored in an entity, property, and relationship (ER) database that is paired with the RAG sources and an external database. The processors may determine, by the verifier LLM, correctness of response based on the comparison, and output the correctness of the response on the user interface.

Abstract: A system to handle cybersecurity threats is disclosed. The system may include a transceiver and a processor. The transceiver may be configured to receive a request from a user via a user interface rendered on a user device. The request may include a query associated with cyber security. The processor may be configured to render the user interface on the user device, and obtain the query from the transceiver. The processor may parse the query into structured data, and identify a sequence of templated actions based on the structured data and a security framework. The processor may map each templated action into one or more action blocks to perform the templated action, based on a user environment. The processor may prepare a workflow to resolve the query based on the sequence of templated actions and the action blocks for each templated action, and perform a predetermined action.