Abstract: A computing system assists in large language model system assisted investigations. The computing system includes network connection hardware configured to connect to a large language model and configured provide to investigation context and investigation goals to the large language model system. The network connection receives from the large language model system, an indication of suggested steps to perform in an investigation, including specific computer executable code to perform a skill in the first step, the skill comprising a supplemental access, analytic or enrichment function. The computing system includes a user interface with a tree interface that causes display of the indication of the suggested steps in a tree format. The computing system is configured to execute the computer executable code to cause the computer system to perform the supplemental access, analytic or enrichment function.

Abstract: A large language model consumes example query expressions, including a data access function, a data analytics function, or a data enrichment function. The large language model receives a centrally managed ontology. The large language model uses the centrally managed ontology, and identifies skill ontological types from the example query expressions. The skill ontological types are normalized (to the centrally managed ontology) input arguments types or structured output. The large language model receives context for an investigation and identifies a context ontological type. The large language model receives received skills, based on correlation between a skill ontological type, having connections in a graph to the received skills, and the context ontological type. The large language model produces and provides an indication of a suggested skill for the investigation.