title: Natural Language Queries category: ChatHub tags: chat, natural-language, ai, nlp, queries priority: Normal

Natural Language Queries

ChatHub supports full natural language interaction -- you can ask questions, request data, and issue commands in plain English. Behind the scenes, an LLM-first routing architecture interprets your intent and directs your message to the appropriate handler.

How LLM-First Routing Works

Every natural language message you send to ChatHub follows a multi-tier processing pipeline. Understanding this architecture helps you write queries that produce the best results.

The 3-Tier Fallback System

When you send a message:

1. Tier 1 (LLM): The message is sent to the configured LLM (Anthropic Claude). The model analyzes your intent, extracts relevant entities (names, types, filters), and returns a structured response with a routing_type field.
2. Tier 2 (Regex): If the LLM is unavailable or returns low confidence, the NaturalLanguageParser applies pattern matching across 18 keyword categories to identify intent.
3. Tier 3 (Commands): If neither tier produces a match, each registered IChatCommand evaluates the input via its CanHandle() method and returns a match confidence score (default 0.5). The highest-confidence command handles the request.

Tip: Slash commands (e.g., /search, /list) bypass all three tiers entirely and go straight to the CommandDispatcher. Use them when you want guaranteed, instant routing.

Routing Types

The LLM returns one of three routing types that determine how your message is handled:

The 18 Keyword Categories

The NaturalLanguageParser (Tier 2) recognizes patterns across these keyword categories for intent classification:

Writing Effective Natural Language Queries

Be Specific

The more context you provide, the more accurate the routing and results.

Use Natural Phrasing

ChatHub understands conversational English. You do not need to structure queries in a specific format.

All of these work:

• "Who are the members of the VPN Access group?"
• "Show me who's in VPN Access"
• "List members of VPN-Access-Group"
• "I need to see the VPN Access group membership"

Combine Criteria

You can include multiple conditions in a single query:

Show me users in the Finance department who haven't logged in for 60 days
Find disabled service accounts that are members of privileged groups
List computers running Windows Server 2019 in the Seattle OU

Ask Follow-Up Questions

ChatHub maintains conversation context. After receiving results, you can ask follow-up questions:

1. You: "Show me members of Domain Admins"
2. ChatHub: (displays member list)
3. You: "Which of those haven't logged in recently?"
4. ChatHub: (filters the previous results by login activity)

Natural Language to Command Routing Examples

Here are examples of how natural language messages are routed to underlying commands:

Follow-Up Suggestion Chips

After every response, ChatHub displays clickable suggestion chips -- contextually relevant follow-up queries based on what you just asked. This helps you explore related data without typing.

How Suggestions Are Generated

Note: Greeting responses intentionally suggest natural language phrases like "What needs my attention?" rather than slash commands like "/insights", making the experience more conversational.

Using Suggestion Chips Effectively

Suggestion chips are designed to guide you through an investigative workflow. A typical session might look like:

1. Start with a briefing: "Good morning"
2. Click: "What needs my attention?"
3. Review the flagged items
4. Click: "Show me inactive admin accounts"
5. Review the list
6. Click: "Disable account temp-admin-02"

Streaming Responses

When ChatHub routes your query as a question type (Tier 1), the response is streamed in real time using SignalR. You see text appearing progressively as the AI generates its answer, similar to a live conversation. This is powered by the RAG pipeline, which retrieves relevant data from your synced directory before generating the response.

Troubleshooting Natural Language Queries

Next Steps

• ChatHub Slash Commands Reference -- Complete command reference for direct actions
• The /briefing Command -- Executive-level environment summaries
• ChatHub Advanced Features -- Saved queries, alerts, and command chaining
• Intelligence Hub Overview -- Understanding the analytics engine behind insights
• Security Hardening -- Secure your IdentityCenter deployment