Abstract: A security system may receive, without a submission of a user query, a model response from a large language model, where the model response includes structured data generated by the large language model using a plurality of security alerts. A security system may render an interface on a computing device using the structured data, where the interface displays information about a security insight event detected by the large language model using the plurality of security alerts, and the interface identifies a portion of the plurality of security alerts as related to the security insight event.