Abstract: Disclosed are techniques and technology for fine-tuning a cybersecurity event response. A method can include receiving, by a computer system, analysis history data associated with the cybersecurity event response and a security outcome of user actions performed in the cybersecurity event response, identifying behavior patterns based on the analysis history data, generating a value for the cybersecurity event response that can correspond to the security outcome of the user actions performed in the cybersecurity event response and the identified behavior patterns, determining at least one suggestion for fine-tuning the cybersecurity event response based on the value for the cybersecurity event response, and returning the at least one suggestion for fine-tuning the cybersecurity event response.

Abstract: Technologies for automated security incident analysis include a computing device that clusters security incidents and runbooks into multiple clusters based on investigation similarity. For each cluster, the computing device determines a summary of all security incidents in the cluster with a large language model, determines criteria for inclusion of a security incident in the cluster, and determines a suggested investigation step with a retrieval augmented generation pipeline. The suggested investigation step includes a natural language description and a programmatic query. Upon receiving approval from a user, the computing device stores the cluster information in a curated query repository. The computing device may receive a security incident for investigation, assign the security incident to a cluster based on the stored criteria, and retrieve a suggested investigation step from the curated query repository. The computing device may provide the suggested investigation step to a user.

Abstract: In some implementations, a cybersecurity threat detection and mitigation system is provided. The system refines an artificial intelligence (AI) model with a corpus of historical data that represents security events that occurred, queries that were submitted by security analysts in response to the security events, and actions that were performed for mitigating the security events. Telemetry data that corresponds to behavior and performance of a computer network is collected and provided to the AI model. Based on the telemetry data, the AI model predicts a potential security threat to the computer network and performs an assessment of risk to the computer network. When the assessment of risk to the computer network indicates that the potential security threat is an actual security threat, a security alert that corresponds to the actual security threat is triggered. Other embodiments are described and claimed.