Abstract: First anomalies are selected from those identified by security analysis, and are enhanced with additional information. Second anomalies occurring within a specified time period and regarding a specified entity, including at least one of the first anomalies, are also selected. A prompt is generated based on the second anomalies. The prompt is generated to solicit a response from a large language model (LLM) including a natural language summary synthesizing the second anomalies. The second anomalies are also evaluated against a database to identify related security threats. Scores for these security threats are generated, and a subset of the threats is selected based on the scores. Another prompt is generated based on the second anomalies and based on the selected subset of security threats. The prompt is generated to solicit a response from an LLM including a natural language summary associating the security threats with the second anomalies.

Abstract: Anomalies regarding a specified entity that occurred within a specified time period are selected from anomalies identified by security analysis performed on raw events. The selected anomalies are enhanced with additional information regarding the selected anomalies. A prompt is generated based on the selected anomalies as have been enhanced. The prompt is generated to solicit a response from a large language model (LLM) including a natural language summary synthesizing the selected anomalies. The generated prompt as input to the LLM, and the response is received as output from the LLM.

Abstract: One or more anomalies are selected from anomalies identified by security analysis performed on a raw events regarding entities. The selected anomalies are enhanced with additional information regarding them. A prompt is generated based on the selected anomalies as have been enhanced. The prompt is generated to solicit a response from a large language model (LLM) including a natural language summary of the selected anomalies. The generated prompt as input to the LLM, and the response is received as output from the LLM.

Abstract: Anomalies regarding a specified entity that occurred within a specified time period are selected and enhanced with additional information. The selected anomalies, as have been enhanced, are evaluated against a database to identify security threats that the selected anomalies are related to. Scores for the identified security threats are generated, and a subset of the security threats that the selected anomalies are related to is selected based on the scores. A prompt is generated based on the enhanced selected anomalies and based on the selected subset of the identified security threats. The prompt is generated to solicit a response from a large language model (LLM) including a natural language summary associating the identified security threats with the selected anomalies regarding the specified entity that occurred within the specified time period. The prompt as input to the LLM, and the response is received as output from the LLM.

Abstract: A system includes a processor and a memory coupled with and readable by the processor and storing therein a set of instructions. When executed by the processor, the processor is caused to receive application events associated with an application and create data records based on the application events. The processor is further caused to compute an interestingness value for each of the data records based on a goal of the application, assign the computed interestingness value to each of the data records and store each of the data records with the assigned interestingness value.

Abstract: A system includes a processor and a memory coupled with and readable by the processor and storing therein a set of instructions. When executed by the processor, the processor is caused to receive application events associated with an application and create data records based on the application events. The processor is further caused to compute an interestingness value for each of the data records based on a goal of the application, assign the computed interestingness value to each of the data records and store each of the data records with the assigned interestingness value.

Abstract: Embodiments of the present disclosure provide a system for generating risk scores in near real-time. The system includes a processor and a memory coupled with and readable by the processor and storing therein a set of instructions. When executed by the processor, the processor is caused to generate risk scores in near real-time by receiving near real-time application events associated with an application in near real-time and identifying anomalies from the near real-time application events. The processor is further caused to generate risk scores in near real-time by generating an intermediate near real-time risk score for the identified anomalies and combining the intermediate near real-time risk score with a batch risk score generated from a batch process executed prior to receiving the near real-time application events to generate a near real-time risk score.