Microsoft patents AI that fixes security threats from visual graphs

1. A computer-implemented method, comprising: receiving, from a training set, a first security image and a ground truth indicator of compromise (IoC) associated with the first security image, wherein: the ground truth IoC is a true reference IoC relating to a particular type or category of cyberthreat; the first security image comprises a first visual representation of a first cybersecurity threat; and the first visual representation depicts a relationship between an alert corresponding to the first cybersecurity threat and an entity associated with the alert; inputting, to a generative machine learning (ML) model, at least one training prompt comprising the first security image and an IoC prediction instruction that requests identification of an IoC based on the depicted relationship between the alert and the entity; receiving a predicted IoC generated by the generative ML model based on the at least one training prompt; updating a parameter of the generative ML model based on a training loss function that quantifies error between the ground truth IoC and the predicted IoC, wherein the updating produces an updated generative ML model; receiving a second security image pertaining to a system, wherein: the second security image comprises a visual incident graph that visualizes a second cybersecurity threat and is generated or collected in response to detection of the second cybersecurity threat; and the visual incident graph comprises an alert node representing the second cybersecurity threat and an entity node representing an entity associated with the alert node; inputting, to the updated generative ML model, at least one mitigation prompt comprising: the second security image; an extraction instruction requesting extraction of a security insight from the visual incident graph; and a mitigation instruction to determine a cybersecurity mitigation action based on the security insight; receiving an indication of the cybersecurity mitigation action generated by the updated generative ML model based on the at least one mitigation prompt; and causing the cybersecurity mitigation action to be performed on the system.