Abstract: A system includes a communications interface configured to receive a plurality of data series captured by a plurality of sensors. A first database includes at least a first data series of the plurality of data series. A second database includes metadata related to the first data series. One or more processors are configured to receive an instruction including an indication of a computation to perform and metadata filter criteria, query the second database to determine at least a portion of the first data series that satisfies the metadata filter criteria by reference to at least the metadata related to the first data series, access, from the first database and based on results of the query of the second database, the portion of the first data series, and perform the computation on the portion of first data series accessed from the first database.

Abstract: A system may use a large language model (“LLM”) to generate a data pipeline. The system can receive a natural language query and a selection of a plurality of data sets for generating a data pipeline and generate a prompt comprising at least: the natural language query, indications of the plurality of data sets, an indication of a format of a first computer language, and an indication of available data transformations. The system can transmit the prompt to an LLM and receive, from the LLM, a response to the prompt in the format of the first computer language. The system can parse the response in the first computer language to identify at least an indication of one or more recommended data transformations. The system can generate, based on the indication of the one or more recommended data transformations, the data pipeline using a second computer language.

Abstract: A system may receive a natural language query. A system may receive indications of one or more data object types, wherein each of the one or more data object types is associated with a respective one or more properties. A system may receive references to one or more data sets, wherein the one or more data sets are each associated with at least a respective data object type. A system may transmit a prompt to a large language model (“LLM”), the prompt comprising at least: the natural language query, the indications of the one or more data object types, and the references to the one or more data sets. A system may receive, from the LLM, a response to the prompt, wherein the response includes indications of: at least a first reference to a first data set and a query to be applied to the first data set.

Abstract: The disclosure is directed to methods and systems for improving interactions with a Large Language Model (LLM). An artificial intelligence system (AIS) can receive user inputs via a graphical user interface indicating a task to be performed by the LLM, one or more tools which may be accessed by the AIS in response to tool calls from the LLM, and an output schema for structuring a format of a response from the LLM. The AIS can generate a prompt for the LLM based on the user input. The prompt can include indications of the one or more tools, one or more example tool operations, the task to be performed, and an indication of the output schema. The AIS can include a debugging application or module enabling rich debugging of language model interactions in a single view.

Abstract: A system may receive a natural language query and receive an indication of a format of a first computer language as well as an indication of one or more computer-based tools stored in and/or accessible by the system. The system can transmit a prompt to a large language model (“LLM”). The prompt may include the natural language query, the indication of the format, and the indication of the one or more computer-based tools. The system can receive, from the LLM, a response to the prompt in the format of the first computer language. The system can parse the response in the first computer language to identify at least: a computer-based tool of the one or more computer-based tools. The system can generate a second query in a second computer language and provide the second query in the second computer language to the computer-based tool.

Abstract: Computer-implemented systems and methods are disclosed, including for determining permissions for nondeterministic model output. A computer-implemented method may include, for example, receiving one or more user inputs including a first user input providing at least a portion of a first prompt for a query for a first nondeterministic model. A computer-implemented method may in response to receiving the one or more user inputs include: executing the query, by the first nondeterministic model, to generate an output, determining a first one or more data inputs used by the first nondeterministic model during execution of the query, determining a first set of permissions associated with the first one or more data inputs; and applying a second set of permissions to at least a first portion of the output based on the first set of permissions.

Abstract: An artificial intelligence system can be used to respond to natural language inputs. The AI System may, for example, receive a first user input for a LLM, generate a first prompt based on the first user input, transmit the first prompt to an LLM, receive an output from the LLM, and evaluate the output from the LLM with reference to one or more validation tests. Responsive to determining that the output from the LLM is not validated, generate a second prompt for the LLM, where the second prompt indicates at least an aspect of the output that caused the output to not be evaluated (e.g., a portion of the output that may need to be updated or corrected), transmit the second prompt to the LLM, and receive an updated output from the LLM. The AI system can include an application for testing functions that utilize interactions with language models.

Abstract: A method, performed by one or more processors, includes: receiving an indication of a desired modification to a cybersecurity event detector that is being contemporaneously used for the detection of potential cybersecurity events in a production environment; modifying, in a sandbox environment, the cybersecurity event detector based on the indication of the desired modification to the cybersecurity event detector; and for each system event in a set of system events, determining, in the sandbox environment, whether the respective system event is indicative of a potential cybersecurity event using the modified cybersecurity event detector. Related apparatus are also disclosed.

Abstract: Systems and methods are provided for storing data representing respective sub-elements of a complex task. Data representing one or more links between two or more sub-elements is stored, the links indicating a dependency between said sub-elements. A work order is calculated based on the identified links. A graphical representation of the calculated work order which indicates said sub-elements and their dependencies is provided. The links may indicate a temporal dependency of a second sub-element on a first sub-element and in which the provided graphical representation presents the temporal relationship of the sub-elements. Historical data may be received for association with one or more selected links or sub-elements, the historical data related to a prior event and which affects the temporal relationship between the sub-elements. An updated work order modified by the historical data may be calculated. An updated graphical representation of the work order may be provided.

Abstract: A system includes a communications interface configured to receive a plurality of data series captured by a plurality of sensors. A first database includes at least a first data series of the plurality of data series. A second database includes metadata related to the first data series. One or more processors are configured to receive an instruction including an indication of a computation to perform and metadata filter criteria, query the second database to determine at least a portion of the first data series that satisfies the metadata filter criteria by reference to at least the metadata related to the first data series, access, from the first database and based on results of the query of the second database, the portion of the first data series, and perform the computation on the portion of first data series accessed from the first database.

Abstract: A method, performed by one or more processors, including: receiving one or more event records; generating, using the one or more event records, an event descriptor object descriptive of one or more events occurring in a networked system, wherein the event descriptor object comprises a plurality of event properties; receiving one or more entity records; generating, using the one or more entity records, an entity descriptor object descriptive of one or more entities relevant to the security of the networked system, wherein the entity descriptor object comprises a plurality of entity properties; incorporating, into an object graph, the event descriptor object and the entity descriptor object; and associating, in the object graph, the event descriptor object with the entity descriptor object using at least one of the plurality of event properties and at least one of the plurality of entity properties.

Abstract: A data ingestion system normalizes ingested documents and extracts data based on a template that is applied to the documents. In an aspect, the system accesses a document of a document type and determines a template to apply to the document. The system normalizes the document, extracts data values from the document based at least in part on the template, and generates structured data based at least partly on the extracted data.

Abstract: A system includes a communications interface configured to receive a plurality of data series captured by a plurality of sensors. A first database includes at least a first data series of the plurality of data series. A second database includes metadata related to the first data series. One or more processors are configured to receive an instruction including an indication of a computation to perform and metadata filter criteria, query the second database to determine at least a portion of the first data series that satisfies the metadata filter criteria by reference to at least the metadata related to the first data series, access, from the first database and based on results of the query of the second database, the portion of the first data series, and perform the computation on the portion of first data series accessed from the first database.

Abstract: A method, performed by one or more processors, including: receiving one or more event records; generating, using the one or more event records, an event descriptor object descriptive of one or more events occurring in a networked system, wherein the event descriptor object comprises a plurality of event properties; receiving one or more entity records; generating, using the one or more entity records, an entity descriptor object descriptive of one or more entities relevant to the security of the networked system, wherein the entity descriptor object comprises a plurality of entity properties; incorporating, into an object graph, the event descriptor object and the entity descriptor object; and associating, in the object graph, the event descriptor object with the entity descriptor object using at least one of the plurality of event properties and at least one of the plurality of entity properties.

Abstract: A method, performed by one or more processors, including: receiving one or more event records; generating, using the one or more event records, an event descriptor object descriptive of one or more events occurring in a networked system, wherein the event descriptor object comprises a plurality of event properties; receiving one or more entity records; generating, using the one or more entity records, an entity descriptor object descriptive of one or more entities relevant to the security of the networked system, wherein the entity descriptor object comprises a plurality of entity properties; incorporating, into an object graph, the event descriptor object and the entity descriptor object; and associating, in the object graph, the event descriptor object with the entity descriptor object using at least one of the plurality of event properties and at least one of the plurality of entity properties.

Abstract: The programming notebook system, methods, and user interfaces described herein provide software developers with enhanced tools by which a programming notebook workflow and session history associated with code cells in a programming notebook may be tracked and maintained. As a developer progresses through a development workflow, the developer can select an option to save a program code card representing some or all of the program code cell inputs. A card editor user interface may present an aggregated listing of all program code the developer has provided across multiple code cells during the current session which the developer can edit, refine, and/or comment. The card editor may also allow the developer to add associated user interface code to display a UI component associated with the program code card, and allow the developer to add a description and tags for the card so that the card can be searched for and reused.

Abstract: Systems and methods are provided for storing data representing respective sub-elements of a complex task. Data representing one or more links between two or more sub-elements is stored, the links indicating a dependency between said sub-elements. A work order is calculated based on the identified links. A graphical representation of the calculated work order which indicates said sub-elements and their dependencies is provided. The links may indicate a temporal dependency of a second sub-element on a first sub-element and in which the provided graphical representation presents the temporal relationship of the sub-elements. Historical data may be received for association with one or more selected links or sub-elements, the historical data related to a prior event and which affects the temporal relationship between the sub-elements. An updated work order modified by the historical data may be calculated. An updated graphical representation of the work order may be provided.

Abstract: A computer system may be configured to access a rule including one or more conditions, providing a user interface configured for user input of a modification to a condition of the rule, receive from a user, via the user interface, a modification to a first condition of the rule constituting a first changed condition, wherein the first changed condition is associated with a modified rule, determine an output data set, based on an input data set including a plurality of past data samples, and the first changed condition of the modified rule, and update the user interface to include a visualization indicating at least some of the output data set.

Abstract: Systems and methods are provided for storing data representing respective sub-elements of a complex task. Data representing one or more links between two or more sub-elements is stored, the links indicating a dependency between said sub-elements. A work order is calculated based on the identified links. A graphical representation of the calculated work order which indicates said sub-elements and their dependencies is provided. The links may indicate a temporal dependency of a second sub-element on a first sub-element and in which the provided graphical representation presents the temporal relationship of the sub-elements. Historical data may be received for association with one or more selected links or sub-elements, the historical data related to a prior event and which affects the temporal relationship between the sub-elements. An updated work order modified by the historical data may be calculated. An updated graphical representation of the work order may be provided.

Abstract: A system for troubleshooting network problems is disclosed. A model can use demographic information, network usage information, and network membership information to determine an importance of a problem. The importance of the problem for the user who reported the problem, a number of other users affected by the problem, and the importance of the problem to the other users can be used to determine a priority for resolving the problem. Before and after a work order is executed to resolve the problem, network metrics can be gathered, including aggregate network metrics, and automatically presented in various user interfaces. The analysis of the metrics can be used to update a database of which work orders are assigned in response to which problems.