Abstract: The disclosed embodiments provide systems and methods for performing queries via an intelligent query engine.

Abstract: Continuous representation of a discrete data model representing a computing environment includes receiving a plurality of event records, each event record generated based on an event in a computing environment, the computing environment including: a resource and a principal; extracting data from the plurality of event records; generating a plurality of aggregated values from the extracted data; and generating a continuous data point between a first aggregated value and a second aggregated value, in response to receiving a request for a data point between the first aggregated value and the second aggregated value.

Abstract: Generating a natural language context from a ticket management system includes receiving an unstructured natural language query from a client device; generating a first prompt for a first large language model (LLM) based on: a predefined template and the unstructured natural language query, the first prompt when processed by the first LLM outputs a structured database query; executing the structured database query on a database, the database including a representation of a cloud computing environment; generating a second prompt for a second LLM based on a result of executing the structured database query, the second prompt when processed by the second LLM outputs a natural language response; and sending the natural language response to the client device.

Abstract: Methods and systems are disclosed for improving the reliability of large language model (LLM) outputs by mapping data from multiple data sources into a unified semantic layer and fine-tuning the LLM based on the semantic layer. An input prompt is processed by the fine-tuned LLM to generate an initial output answer. This output is automatically validated by generating and executing a database query derived from the output answer. The final validated answer is presented when the initial answer and query results match within a predefined threshold, reducing false or hallucinated responses. Practical applications include enhanced cybersecurity monitoring, automated threat investigation, and tenant-specific response generation in multi-tenant environments.

Abstract: A system and method for detecting a protection gap in a cybersecurity system is provided. The method includes scanning a computing environment to detect a cybersecurity monitoring system connected to the computing environment; scanning the computing environment to detect a plurality of resources deployed in the computing environment; detecting a resource of the plurality of resources which is of a first resource type; determining that the cybersecurity monitoring system is not configured to monitor the first resource type; and initiating a mitigation action in response to determining that the cybersecurity monitoring system is not configured to monitor the first resource type.

Abstract: A system and method for load management and back pressure reduction in managing support ticket resolution is presented. The method includes continuously determining support ticket resolution capacity based on a number of previously resolved support tickets; continuously receiving a plurality of support tickets; periodically determining a severity score associated with each support ticket of the plurality of support tickets; and assigning a support ticket of the plurality of support tickets to a user account based on the determined severity score and the determined resolution capacity, such that a number of assigned support tickets to the user account does not exceed the determined resolution capacity.

Abstract: A system and method are disclosed for reducing false responses from a large language model. The method includes: mapping a data field from a first source to a semantic layer, the semantic layer including a plurality of data fields; storing data from the first source in a database based on the semantic layer; tokenizing each data field for a first large language model (LLM); fine-tuning the first LLM based on the tokenized semantic layer; providing a prompt to the first LLM, which configures it to generate an output answer; providing the output answer to a second LLM, which configures it to generate a query for the database; executing the query on the database to generate a database output based on the stored data; and providing the output answer in a user interface (UI) in response to determining that the database output and the output answer are within a predefined threshold.

Abstract: A system and method for generating a cybersecurity risk profile based on an identity in a computing environment is disclosed. The method includes: detecting a plurality of identities in a computing environment, each identity including a permission to initiate an action in the computing environment; querying an identity and access management service to detect a permission associated with a first identity of the plurality of identities; accessing an activity log of the computing environment; parsing the activity log to detect an event based on the first identity; and generating an identity risk profile based on: the detected event, and the detected permission.

Abstract: Generating unified cybersecurity signals from multiple sources includes receiving a plurality of cybersecurity signals each determined based on monitoring a computing environment by a plurality of cybersecurity monitoring systems, including at least two disparate cybersecurity monitoring systems; managing a graph based on the plurality of cybersecurity signals where the graph includes nodes of entities in the computing environment and vertices representing relationships between the nodes, wherein the managing includes utilizing a unified node in the graph for two cybersecurity signals from the at least two disparate cybersecurity monitoring systems; analyzing the graph to determine a representation of the computing environment; and managing the computing environment based on the analyzing the graph including determining one or more cybersecurity threats in the computing environment and associated severity.

Abstract: A system and method are disclosed for reducing false responses from a large language model. The method includes: mapping a data field from a first source to a semantic layer, the semantic layer including a plurality of data fields; storing data from the first source in a database based on the semantic layer; tokenizing each data field for a first large language model (LLM); fine-tuning the first LLM based on the tokenized semantic layer; providing a prompt to the first LLM, which configures it to generate an output answer; providing the output answer to a second LLM, which configures it to generate a query for the database; executing the query on the database to generate a database output based on the stored data; and providing the output answer in a user interface (UI) in response to determining that the database output and the output answer are within a predefined threshold.

Abstract: A system and method for cybersecurity vulnerability management through ticket system reduction reduces alert fatigue. The method includes, responsive to monitoring of a computing environment by a plurality of cybersecurity monitoring systems, receiving a plurality of alerts from the plurality of cybersecurity monitoring systems that provide overlapping detection of cybersecurity issues and do not communicate with one another, such that a given alert from each of the plurality of cybersecurity monitoring systems possibly relates to a same cybersecurity issue; preprocessing the plurality of alerts to identify any alerts for the same cybersecurity issue; and generating tickets for the plurality of alerts including a unified ticket for the any alerts for the same cybersecurity issue thereby reducing tickets by using the unified ticket for duplicate alerts from the plurality of cybersecurity monitoring systems.

Abstract: A system and method for generating an application layer for a representation graph is disclosed. The method includes defining a data entity in a representation graph, the data entity including a plurality of data fields; generating a node based on the data entity in the representation graph, the node representing a unique entity; receiving data respective of the unique entity from a plurality of data sources, such that a first data source of the plurality of data sources provides data to a first data field of the plurality of data fields, and a second data source of the plurality of data sources provides data to a second data field of the plurality of data fields; applying a control to the node based on the received data; and initiating an action based on applying the control to the received data.

Abstract: A system and method for cybersecurity vulnerability management through ticket system reduction reduces alert fatigue. The method includes receiving a plurality of alerts from a cybersecurity monitoring system, the cybersecurity monitoring system configured to monitor a computing environment, wherein each alert includes a plurality of attributes; generating in a graph database a ticket node corresponding to each alert of the received plurality of alerts; generating in the graph database a ticket group node, the ticket group node connected to a plurality of ticket nodes, each ticket node of the plurality of ticket nodes corresponding to an alert having an attribute with a same value; generating a ticket in a ticketing system corresponding to the ticket group node; and generating a visual representation of the ticket corresponding to the ticket group node.

Abstract: A system and method for generating a compact representation of a compute environment based on generating uber objects in a graph database from a plurality of sources is disclosed. The method includes receiving object metadata of an entity from a first source; receiving object metadata of the cloud entity from a second source, the second source operating independently of the first source; and generating an uber node representing the cloud entity based on a predefined schema in a graph database, the received object metadata from the first source and the received object metadata from the second source.

Abstract: A system and method for unifying cybersecurity data for threat management utilizes a plurality of cybersecurity monitoring systems. The method includes receiving a first cybersecurity signal from a first monitoring system, the first monitoring system configured to monitor a computing environment for a cybersecurity threat; receiving a second cybersecurity signal from a second monitoring system, the second monitoring system configured to monitor the computing environment for the cybersecurity threat, wherein the second monitoring system is independent of the first monitoring system; generating a unified cybersecurity object based on the first cybersecurity signal and the second cybersecurity signal; and determining a severity level of the cybersecurity threat based on the unified cybersecurity object.

Abstract: A system and method for cybersecurity vulnerability management through ticket system reduction reduces alert fatigue. The method includes receiving a plurality of alerts from a cybersecurity monitoring system, the cybersecurity monitoring system configured to monitor a computing environment, wherein each alert includes a plurality of attributes; generating in a graph database a ticket node corresponding to each alert of the received plurality of alerts; generating in the graph database a ticket group node, the ticket group node connected to a plurality of ticket nodes, each ticket node of the plurality of ticket nodes corresponding to an alert having an attribute with a same value; generating a ticket in a ticketing system corresponding to the ticket group node; and generating a visual representation of the ticket corresponding to the ticket group node.

Abstract: A system and method for providing big data analytics responsive to dynamically-changing data models are provided. The method includes parsing, based on a logical data schema, a user query into a plurality of sub-queries; sending the plurality of sub-queries to a plurality of data stores, wherein each data store is selected based on a physical data schema of a dynamic data schema; receiving a plurality of sub-result datasets, wherein each sub-result dataset corresponds to a sub-query; and combining the plurality of sub-result datasets into a single resulting data set based on a logical schema of the dynamic data schema, wherein the combining includes at least any of: an aggregation operation and a join operation.

Abstract: A system and method for normalizing campaign data gathered from a plurality of advertising platforms. The method comprises receiving campaign data related to at least one campaign gathered from a plurality of advertising platforms; mapping data dimensions in the received campaign data to a marketing data model to produce a dataset that is organized and functions as the marketing data model; normalizing data values in the dataset according to a unified notation defined for each of the data dimensions in the marketing data model; and optimizing the normalized dataset to allow faster manipulation of data.

Abstract: A system and method for providing big data analytics responsive to dynamically-changing data models are provided. The method includes parsing, based on a logical data schema, a user query into a plurality of sub-queries; sending the plurality of sub-queries to a plurality of data stores, wherein each data store is selected based on a physical data schema of a dynamic data schema; receiving a plurality of sub-result datasets, wherein each sub-result dataset corresponds to a sub-query; and combining the plurality of sub-result datasets into a single resulting data set based on a logical schema of the dynamic data schema, wherein the combining includes at least any of: an aggregation operation and a join operation.

Abstract: A system and method for normalizing campaign data gathered from a plurality of advertising platforms. The method comprises receiving campaign data related to at least one campaign gathered from a plurality of advertising platforms; mapping data dimensions in the received campaign data to a marketing data model to produce a dataset that is organized and functions as the marketing data model; normalizing data values in the dataset according to a unified notation defined for each of the data dimensions in the marketing data model; and optimizing the normalized dataset to allow faster manipulation of data.