Metraipolis › archive › dc_6789cd3fcbd7

Operationalizing Cyber Threat Intelligence with GraphRAG — arXiv:2608.13050

Source: arXiv (en)
Original: https://arxiv.org/abs/2608.13050
License (as archived): CC0-1.0
Archived: 2026-10-19T04:18:19.352Z
SHA-256 of the archived text: 752d6d36c9b3422312d4347530866af504d3a6389783470893bf00b71ab70834
Stable URL of this page: https://metraipolis.com/documento/dc_6789cd3fcbd7

How to cite

Operationalizing Cyber Threat Intelligence with GraphRAG — arXiv:2608.13050 — arXiv (en), https://arxiv.org/abs/2608.13050 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_6789cd3fcbd7 (Metraipolis archive dc_6789cd3fcbd7, sha256 752d6d36c9b3422312d4347530866af504d3a6389783470893bf00b71ab70834)

BibTeX

@misc{dc6789cd3fcbd7,
  title = {Operationalizing Cyber Threat Intelligence with GraphRAG — arXiv:2608.13050},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2608.13050},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_6789cd3fcbd7; sha256 752d6d36c9b3422312d4347530866af504d3a6389783470893bf00b71ab70834},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2608.13050. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

When a security researcher publishes a report on a cyberattack, detection engineers are supposed to turn it into working detection rules. In practice, most automated attempts at this only extract the simplest clues from the report --- bad IP addresses, domain names, and file hashes --- and turn them into block lists. This is a weak strategy, because attackers can change these simple clues within hours or days, so the resulting detections stop working almost as soon as they are deployed. Security teams describe this idea with the Pyramid of Pain. This project asks whether feeding a report into a knowledge-graph retrieval system, Microsoft GraphRAG, rather than a standard vector-similarity retrieval system (Naive RAG), produces detection plans that rely more on these durable, top-of-pyramid clues. Both systems are given the same report, the same generation instructions, and the same language model to write the final plan; only the retrieval step differs. In a detailed case study of one APT28 report, the GraphRAG plan kept firing at 100\% of its detections after every IP address, domain, and file hash in the report was rotated, while the Naive RAG plan kept firing at only 29\%. Repeating the comparison across nine real CTI reports from four vendors confirms the same pattern: GraphRAG plans consistently reach higher, harder-to-evade levels of the pyramid, even when the two systems end up close on total score. The results support treating knowledge-graph-aware retrieval as the architecturally correct foundation for automatically generating SOC-deployable hunting plans, while showing that the wording of the generation prompt matters almost as much as the retrieval back-end itself.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-08-14 in cs.AI).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2608.13050 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-19T04:13:06.732Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-08-14?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).