QUERY COPILOT — Engineering Proposal Page 1

QUERY COPILOT
An AI system that translates plain-English intent into valid KQL — giving security analysts results in 30
seconds instead of 30 minutes.

10× $500K 95%+ 30 sec

faster query generation annual labor savings per accuracy with field mapping results vs 30 minutes
SOC manually

01 — PROBLEM

Security analysts are drowning in query work

Writing KQL manually is slow, error-prone, and expensive. Analysts memorize 100+ field names and syntax rules,
spending 30–60 minutes on a single complex query — while incidents wait.

Metric Reality

Daily KQL writing time 3–4 hours per analyst

Monthly waste (5–10 analyst SOC) 500+ hours lost

Fields to memorize per log source 100+

Time for a single complex query 30–60 minutes

Existing alternatives fall short

Tool Limitation The Gap

Kibana Manual KQL only — no AI Slow by design

Splunk AI Assistant AI exists Prohibitively expensive ($$$)

Microsoft Copilot Windows-focused Not for security logs

MS Security Copilot Sentinel only No local LLM / cost control

Confidential — Internal Engineering Document [Link]

QUERY COPILOT — Engineering Proposal Page 2

02 — SOLUTION

How Query Copilot works

An analyst types a natural-language description. The system processes it through a 5-step pipeline and returns results in
seconds.

Your log schema is injected into the LLM prompt — the model understands
1 Field mapping injection
YOUR specific fields.

2 KQL generation The LLM returns a syntactically valid, schema-aware KQL query.

3 Validation Query is checked for syntax and schema correctness before any execution.

4 Elasticsearch execution The validated query runs against your log store immediately.

5 Results in seconds Analyst reviews and acts — full query visible for audit at all times.

Core value propositions

Benefit Description Impact

■ Speed Describe intent, skip syntax 3 hrs → 3 min

■ Accuracy LLM knows your field mappings 95%+ accuracy

■ Cost control Multi-provider routing 40% cost savings

■ Resilience Local Llama 2 fallback Never goes down

■ Transparency Generated query stays visible Full audit trail

03 — ARCHITECTURE

System components
Ten purpose-built components spanning the full query lifecycle.

Component Purpose Role

Frontend (React) UI where analysts type intent Interface

Confidential — Internal Engineering Document [Link]

QUERY COPILOT — Engineering Proposal Page 3

Component Purpose Role

Backend ([Link]) Handles requests, routes to LLM API Layer

LLM Router Picks cheapest / fastest provider Routing

KQL Generator Converts intent to valid KQL Core Logic

Query Validator Checks syntax + schema pre-run Safety

Cost Monitor Tracks tokens, prevents overspend Finance

Fallback System Switches to local LLM on API failure Resilience

Local LLM (Llama 2) On-premise via Ollama Privacy

Analytics Dashboard Query history + usage stats Reporting

Benchmarking Compare accuracy, latency, cost Performance

Technology stack
Technology Purpose Why

React Frontend UI Industry standard, fast

[Link] + Express Backend API Handles LLM calls, scalable

TypeScript All code Prevents bugs, professional

Elasticsearch Log database KQL execution target

Kibana Query visualization Industry standard

OpenAI + Claude Primary LLM providers Best accuracy

Ollama / Llama 2 Local LLM fallback No API cost, offline

Redis Caching + rate limiting Speed + budget control

PostgreSQL Queries, history, costs Full audit trail

Docker Containerization Easy deployment

LangChain LLM orchestration Multi-provider management

04 — FEATURES

Confidential — Internal Engineering Document [Link]

QUERY COPILOT — Engineering Proposal Page 4

Core features
# Feature What It Does Impact

1 Natural language → KQL Type English, get valid KQL 10× faster queries

2 Multi-provider support OpenAI, Claude, Gemini No vendor lock-in

3 Fallback to local LLM Offline Llama 2 via Ollama Always available

4 Query validation Syntax + schema pre-execution Prevents errors

5 Cost estimation Predicts token cost upfront Budget control

6 Rate limiting Caps queries per hour Prevents overspend

7 Query history All queries saved & reusable Audit + learning

8 Smart caching Common queries at $0 cost Instant results

9 Provider selection Picks cheapest/fastest 40% cost savings

1
Elasticsearch integration Direct query execution One-click results
0

1
Real-time feedback Results appear as you type Better UX
1

1
Token usage dashboard Per-user spend tracking Accountability
2

1
Query accuracy scoring Marks results good/bad Continuous improvement
3

1
Batch query mode Multiple queries → 1 API call Higher efficiency
4

1
Field mapping injection LLM sees your schema 95%+ accuracy
5

Advanced differentiating features

Field mapping intelligence Auto-learns your Elasticsearch schema. 95%+ accuracy vs 70% without.

Semantic query versioning Queries auto-versioned when results drift. Makes non-deterministic LLM
output deterministic — alerts never false-trigger.

Cross-provider consensus Runs the same intent on 3 providers, compares answers. Catches
hallucinations via majority voting.

Confidential — Internal Engineering Document [Link]

QUERY COPILOT — Engineering Proposal Page 5

Anomaly detection on results Detects: '500 results today vs 20 yesterday.' Alerts analyst to schema drift.
Prevents missing attacks.

Analyst behavior profiling Tracks normal patterns. Detects shifts (e.g., 'failed logins' → 'privilege
escalation') and proactively surfaces suggestions.

Compliance audit trail Every query version tracked and analyst-approved. Supports SOC 2 / ISO
27001 certification.

Benchmark comparisons Compare same query across providers. Data-driven: 'OpenAI is faster, Claude
is cheaper.'

Batch query optimization Combines multiple questions into one API call. 30% cost savings on bulk
investigations.

Smart context injection Only includes relevant fields per prompt. 50% cheaper and faster — better
cost-latency tradeoff.

Alert dependency mapping Shows which alerts use a given query. Prevents deletion of compliance-critical
detection logic.

AI-powered query optimization Recommends optimized queries using Elasticsearch's query planning.
Reduces execution from seconds to milliseconds.

Query canonicalization Standardizes different phrasings into one canonical form. 'Same question =
same query' — consistent caching even with non-deterministic models.

Accuracy feedback loop Analysts mark results as good/bad to train the provider picker. System
improves automatically over time.

05 — CACHING

Multi-layer Redis caching

Four distinct cache layers maximize speed and minimize redundant API calls. 80% of queries are served from cache at
$0 additional cost.

Cache Layer What Is Stored TTL Benefit

Query cache User intents → KQL queries 24 hours No re-processing identical requests

Schema cache Database field mappings 1 hour Faster query generation

LLM response cache Exact prompt → response pairs Persistent Eliminates repeat API calls

Confidential — Internal Engineering Document [Link]

QUERY COPILOT — Engineering Proposal Page 6

Cache Layer What Is Stored TTL Benefit

Result cache Raw Elasticsearch results 5 minutes Reduces DB load on frequent searches

06 — RELIABILITY

Scalability & failover

Built to survive provider outages, database failures, and traffic spikes without downtime.

Scalability mechanisms

Mechanism Description

Load balancer Distributes queries across 5+ backend instances

Horizontal scaling Auto-adds servers when the query queue grows

Caching (Redis) 80% of queries served instantly — $0 marginal cost

Batch processing Groups LLM calls to reduce total API requests by ~30%

Reliability patterns
Pattern Behaviour

Health checks Every 10 seconds — detects service failure instantly

Auto-failover Automatically redirects traffic to backup on failure

Circuit breaker Opens (stops calls) when failure rate exceeds 5%

DB replication PostgreSQL with 3-way replication for HA

Failover matrix

Failure Scenario System Response

Primary LLM API down Switch to secondary API in under 5 seconds

Database down Read replica with acceptable slight lag

All LLM APIs down Local Llama 2 on-premise (slower, always available)

Elasticsearch down Cached results returned + error message to analyst

Confidential — Internal Engineering Document [Link]

QUERY COPILOT — Engineering Proposal Page 7

07 — SECURITY

Security controls
Control Details

API key encryption All API keys encrypted in database — never stored plaintext

Query validation Every query validated for syntax and schema before execution

Audit logging Every query, every approval, every action logged with timestamp

Data isolation Each customer's queries and results fully separated (row-level)

Encryption in transit TLS 1.3 enforced on all network traffic

Role-based access (RBAC) Admin → Lead Analyst → Analyst permission hierarchy

DB replication security PostgreSQL 3-way replication, all data encrypted at rest

08 — PRICING & MARKET

Market segments
Segment Team Size Primary Need

Mid-market SOCs 20–100 analysts Speed + cost control

Enterprise security teams 100+ analysts Compliance + automation

MSSP (Managed Security) Multi-customer Efficiency = profit

Startups 5–20 analysts Cost (can't afford more analysts)

Pricing tiers

Tier Price Includes Best For

Pay as you go $10 per 100

Per-query $0.10 / query Small teams, startups
queries

Confidential — Internal Engineering Document [Link]

QUERY COPILOT — Engineering Proposal Page 8

Tier Price Includes Best For

$200 / month per Unlimited queries Predictable

Per-analyst subscription Large SOCs
analyst revenue

$500 / month base +

1,000 queries included
Hybrid (Enterprise) $0.05 per query Enterprise customers
Transparent LLM pass-through
overage

09 — SUMMARY

Query Copilot in one paragraph

Query Copilot helps security analysts search logs in seconds instead of hours. Analysts describe what
they want in plain English, the system generates valid KQL automatically, and results appear instantly.
It saves teams $500K/year in labor costs and makes incident response 10× faster — turning a 3-hour
daily burden into a 3-minute workflow.

Outcome Metric

Annual labor savings per SOC $500,000

Query time reduction 3 hours → 3 minutes (10× faster)

Analyst productivity multiplier 1 analyst does the work of 10

Incident response improvement 10× faster

Query accuracy (with field mapping) 95%+

Queries served from cache 80% at $0 marginal cost

Cost savings via provider routing 40%

Confidential — Internal Engineering Document [Link]