Large language model based security insights

Abstract

Methods, systems, and devices for large language model (LLM) based security insights and/or recommendations at a data security system are described. A data security system may obtain event information associated with monitored computing assets and/or user accounts for a client or customer of the data security system. The data security system may filter the event information and associated computing asset and/or user account information in accordance with a security policy for the client and may generate a prompt for an LLM based on the filtered event and computing asset and/or user account information. The data security system may provide the prompt to the LLM, and the LLM may provide a natural language response to the prompt that provides a security action recommendation to resolve one or more events and/or insights such as a rationale for the security action recommendation and/or an explanation of threats associated with the event.