Abstract: Technologies for automated security incident analysis include a computing device that clusters security incidents and runbooks into multiple clusters based on investigation similarity. For each cluster, the computing device determines a summary of all security incidents in the cluster with a large language model, determines criteria for inclusion of a security incident in the cluster, and determines a suggested investigation step with a retrieval augmented generation pipeline. The suggested investigation step includes a natural language description and a programmatic query. Upon receiving approval from a user, the computing device stores the cluster information in a curated query repository. The computing device may receive a security incident for investigation, assign the security incident to a cluster based on the stored criteria, and retrieve a suggested investigation step from the curated query repository. The computing device may provide the suggested investigation step to a user.