Systems and methods for false positive suppression through deployment of generative artificial intelligence

Abstract

Disclosed herein are systems and methods directed to suppressing alerts of false positive anomalies. In particular, user feedback may be obtained on detected anomalies and utilized in prompt engineering of a large language model (LLM) as a one-shot or one of a few-shot examples. The prompt may be automatically engineered and constructed to instruct the LLM to determine whether a set of recently detected anomalies are false positives. Additionally, the prompt may be engineered to include numerous attributes of each of the recent set of anomalies including an anomaly name, an anomaly summary, a model or rule name that identified an event, behavior, or trend as the anomaly, feature names and values, an anomaly score, and/or an event timestamp. The response from the LLM may be utilized in generation of a graphical user interface that indicates a subset of the recent set of anomalies as false positives.