QUERY COPILOT
AI-Powered KQL Query Generation for Security Analysts
Product Architecture & Technical Documentation
1. EXECUTIVE SUMMARY
Security analysts spend 3–4 hours daily writing KQL (Kusto Query Language) queries — a
specialized syntax for searching logs. This process is slow, error-prone, and expensive. Query
Copilot is an AI-powered system that translates natural language into valid KQL automatically,
reducing a 3-hour task to a 3-minute one.
⚡ 10x Faster $500K/Year 95%+ Accuracy 30 Seconds
Query generation Labor savings per SOC With field mapping Results vs 30 minutes
2. PROBLEM STATEMENT
2.1 The Current Pain
Security analysts write KQL queries manually to search logs. This is an inefficient, error-prone
process that costs organizations heavily in time and money.
• Security analysts spend 3–4 hours per day writing KQL queries manually
• Analysts must memorize 100+ field names, syntax rules, and log structure
• Writing a single complex query takes 30–60 minutes
• SOCs with 5–10 analysts waste 500+ hours per month collectively
2.2 Current Systems (Competitors)
System Limitation Issue
Kibana Manual KQL only Slow — no AI assistance
Splunk AI Assistant AI exists Very expensive ($$$)
Microsoft Copilot Windows-focused Not for security logs
Microsoft Security Copilot Only works with Microsoft Sentinel No local LLM, no cost optimization
3. THE SOLUTION — QUERY COPILOT
3.1 How It Works
An analyst types a natural language description such as 'Show me failed logins from unusual
IPs.' The system processes this through a 5-step pipeline:
1. Injects your log structure (field mappings) into an LLM prompt
2. Gets back a KQL query from the LLM
3. Validates the query before execution
4. Runs the validated query in Elasticsearch
5. Shows results in seconds
3.2 Core Value Propositions
Icon Benefit Description Impact
⚡ Speed Analysts describe intent, don't write 10x faster
queries
🎯 Accuracy LLM understands field mappings and 95%+ accuracy
log structure
💰 Cost Control Multiple AI providers — picks 40% cost savings
cheapest
🔧 Resilience Falls back to local LLM if external APIs Always available
fail
🧠 Transparency Generated query stays visible for audit Full accountability
3.3 Real-World Impact
The practical transformation Query Copilot delivers:
• 3-hour task → 3-minute task
• One analyst does the work of 10
• SOC saves $500,000/year in labor costs
• Incident response is 10x faster
4. SYSTEM ARCHITECTURE
4.1 Component Overview
Component Purpose Why Role
Frontend (React) UI where analysts type their User-friendly input Interface
intent
Backend ([Link]) Handles requests, routes to Fast, scalable API Layer
LLM
LLM Router Chooses between OpenAI / Cost optimization Routing
Claude / local
KQL Generator Converts natural language Core logic Core
intent to valid KQL
Query Validator Checks if KQL is Prevents bad queries Safety
syntactically correct
Cost Monitor Tracks token usage, Budget control Finance
prevents overspend
Fallback System Uses local LLM if all APIs Always available Resilience
fail
Local LLM Support Runs Llama 2 on-premise Privacy + cost savings Offline
Dashboard Shows query history and Analytics Reporting
analytics
Benchmarking Compares accuracy, Performance tracking Optimization
latency, and cost
4.2 Technology Stack
Technology Purpose Why Chosen
React Frontend UI Industry standard, fast
[Link] + Express Backend API Handles LLM calls, fast
TypeScript All code Prevents bugs, professional
Elasticsearch Log database where KQL runs Industry standard log search
Kibana Query visualization Industry standard
OpenAI + Claude APIs Primary LLM providers Best accuracy
Ollama (Llama 2) Local LLM fallback No API cost, offline capable
Redis Caching + rate limiting Speed + budget control
PostgreSQL Store queries, history, costs Audit trail
Docker Containerization Easy deployment
LangChain LLM orchestration Managing multiple providers
5. ALL SYSTEM FEATURES
5.1 Core Features
# Feature What It Does Real Impact
1 Natural Language to KQL Type in English, get KQL 10x faster queries
2 Multi-Provider Support Works with OpenAI, Claude, Cheapest pricing, no vendor lock-
Gemini in
3 Fallback to Local LLM Uses offline Llama 2 if APIs fail Never goes down
4 Query Validation Checks syntax + schema Prevents errors
before run
5 Cost Estimation Predicts token cost upfront Budget control
6 Rate Limiting Caps queries per hour Prevents overspend
7 Query History Saves all generated queries Reuse, audit, learning
8 Smart Caching Remembers common queries Instant results, $0 cost
9 Provider Selection Picks cheapest/fastest provider 40% cost savings
10 Elasticsearch Integration Direct query execution One-click results
11 Real-time Feedback Shows results while typing Better UX
12 Token Usage Dashboard Track spending per user Accountability
13 Query Accuracy Scoring Measures if query worked Feedback for improvement
14 Batch Query Mode Run multiple queries together Higher efficiency
15 Field Mapping Injection Shows LLM your log structure Better accuracy
5.2 Advanced / Differentiating Features
Field Mapping Intelligence
• Auto-learns your Elasticsearch schema
• LLM understands YOUR specific logs
• 95%+ accuracy vs 70% without field mapping
Query Accuracy Feedback Loop
• Analyst marks results as 'good/bad' to train the picker
• Improves itself automatically over time
Alert Dependency Mapping
• Shows which alerts use a given query
• Prevents deletion or modification of critical queries
• Prevents compliance failures
Benchmark Comparisons
• Compare the same query across multiple providers
• Data-driven decisions: 'OpenAI is faster, Claude is cheaper'
Batch Query Optimization
• Combines multiple questions into one API call
• 30% cost savings on bulk investigations
Smart Context Injection
• Only includes relevant fields in the prompt
• 50% cheaper and faster — better cost-latency tradeoff
Semantic Query Versioning
• Queries get auto-versioned when results drift
• Makes LLM non-deterministic output deterministic
• Alerts never false-trigger from LLM variance
Cross-Provider Query Consensus
• Runs the same intent on 3 providers and compares answers
• Catches LLM hallucinations via majority voting
• Essential for high-security investigations
Anomaly Detection on Query Results
• Detects unusual shifts such as: 'This query returned 500 results, yesterday 20 —
something changed!'
• Alerts analyst to log structure changes
• Prevents missing attacks due to schema drift
AI-Powered Query Optimization
• Recommends optimized queries, reducing execution time from seconds to milliseconds
• Utilizes advanced query planning capabilities within Elasticsearch
Analyst Behavior Profiling
• Tracks analyst behavior patterns (e.g., analyst usually searches 'failed logins')
• Detects shifts in focus (e.g., pivot to 'privilege escalation') and offers proactive
suggestions
• Enables faster investigation and work
Compliance Audit Trail
• Every query version is tracked and approved by an analyst
• Supports passing SOC 2 / ISO 27001 audits
• Auditors love the full traceability
Achieving Determinism
By canonicalizing queries, the system can enforce consistent outputs ('same question = same
query') even when using non-deterministic models that typically produce varied responses for
identical inputs.
Query Canonicalization
This process standardizes different phrasings of the same question into a single canonical form,
allowing for better tracking and caching across all queries.
6. CACHING ARCHITECTURE
Query Copilot uses a multi-layer Redis caching strategy to maximize speed and minimize cost:
Cache Type What Is Cached TTL / Benefit
Query Cache User intents mapped to KQL queries 24 hours — prevents re-
in Redis processing identical requests
Schema Cache Database field mappings 1 hour — speeds up query
generation
LLM Response Cache Exact prompt-to-response pairs Indefinite — avoids expensive
repeat API calls
Result Cache Raw Elasticsearch search results 5 minutes — reduces database
load for frequent searches
7. SECURITY
7.1 Security Controls
• API Keys: Encrypted in database
• Query Validation: Always checked before execution
• Audit Logging: Every query and approval is logged
• Data Isolation: Each customer's queries are fully separate
• Encryption: TLS 1.3 for all network traffic
• RBAC (Role-Based Access Control): Admin → Lead Analyst → Analyst hierarchy
7.2 Database Security
• PostgreSQL with 3-way replication for high availability
• All sensitive data encrypted at rest and in transit
8. SCALABILITY & RELIABILITY
8.1 Scalability Mechanisms
Mechanism Description
Load Balancer Distributes queries across 5+ backend instances
Horizontal Scaling Auto-adds servers when the query queue grows
Caching (Redis) 80% of queries are served from cache instantly at $0 additional cost
Batch Processing Groups LLM API calls together to reduce total API requests
8.2 Reliability Patterns
Health Checks
Automated monitoring processes that periodically check the status of a service — in this case,
every 10 seconds — to detect if it is running correctly.
Auto-Failover
If a health check determines a service is down, the system automatically redirects traffic or
switches to a backup service to maintain availability.
Circuit Breaker
This pattern prevents a system from repeatedly trying to call a failing service, which can cause
cascading failures. The circuit breaker opens — stops making calls — when the failure rate
exceeds 5%.
8.3 Failover Matrix
Failure Scenario System Response
Primary API Down Switch to secondary LLM API in 5 seconds
Database Down Use read replica (slight lag acceptable)
All LLM APIs Down Use local Llama 2 on-premise (slower but available)
Elasticsearch Down Return cached results + display error message to analyst
9. PRICING & BUSINESS MODEL
9.1 Target Market Segments
Segment Size Primary Need
Mid-market SOCs 20–100 analysts Speed + cost control
Enterprise Security Teams 100+ analysts Compliance + automation
MSSP (Managed Security) Multi-customer Efficiency = profit
Startups 5–20 analysts Cost (can't afford more analysts)
9.2 Pricing Tiers
Tier 1 — Per-Query Pricing
• $0.10 per query
• Only pay for what you use
• Best for: Small teams, startups
• Revenue model: $10 per 100 queries
Tier 2 — Per-Analyst Subscription
• $200/month per analyst user
• Unlimited queries included
• Best for: Large SOCs
• Revenue model: Predictable, recurring monthly income
Tier 3 — Hybrid Model (Recommended for Enterprise)
• Base fee: $500/month (includes 1,000 queries)
• Overage: $0.05 per additional query
• LLM API costs passed through transparently
• Best for: Enterprise customers requiring scalability and predictability
10. CONCLUSION
Query Copilot helps security analysts search logs in seconds instead of hours. Analysts simply
describe what they want in plain English, the system generates the Kibana/Elasticsearch KQL
query automatically, and results are returned instantly.
The system delivers measurable, transformative outcomes:
• Saves security teams $500,000/year in labor costs
• Makes incident response 10x faster
• Reduces a 3-hour task to a 3-minute task
• Enables one analyst to do the work of ten
• Provides full compliance, audit trail, and security controls
Query Copilot is not just a productivity tool — it is a force multiplier for any security operations
team, delivering enterprise-grade AI-powered log analysis at a fraction of the cost of existing
solutions.