System extracts actionable cyber threat leads from intelligence reports
Evidence-Grounded Retrieval for Investigation Hunt Lead Generation from CTI Reports
Cryptography and SecurityArtificial Intelligence
Summary
Cybersecurity teams need clear, testable leads to hunt for online threats, but these leads are hard to create from complex reports. The authors created AHLERT, a system that automatically finds and organizes relevant clues from threat reports, linking them to the defender’s own technology setup. This helps make threat hunting faster and more reliable by focusing on evidence and known attacker behaviors. Tests showed AHLERT performs much better than previous methods using large language models alone.
What this means in practice
- •For security operations teams: Generate focused and actionable threat hunt leads directly from intelligence reports tailored to their specific IT environment.
- •For security product developers: Enhance threat detection tools by integrating automated evidence-grounded lead generation for better incident investigation support.$Commercial implications: Enables building enhanced cyber defense products that provide automated, environment-aware threat hunting leads, differentiating offerings.
Authors
Akash Prakash, Boubakr Nour, Makan Pourzandi, Chadi Assi, Mourad Debbabi
Abstract
Threat hunting increasingly depends on converting unstructured knowledge (e.g., Cyber Threat Intelligence reports) into actionable hunt leads: concise, investigable hypotheses grounded in observable artifacts and adversary techniques. Producing such leads manually is a tedious and hard-to-scale task. Existing automated approaches stop at the entity layer, ignore the defender's operational environment, and analyze each report in isolation. To address these gaps, we introduce AHLERT, a system that automatically extracts relevant, environment-aware, and hunt leads from threat reports through (i) a hybrid retriever that combines dense vector search with multi-hop traversal over a knowledge graph seeded with MITRE ATT&CK; (ii) an ontology-grounding retrieval-augmented generation method that constrains each lead to the defender's own assets and controls; and (iii) an LLM-agnostic framework that emits structured, directly actionable leads rather than loose indicators of compromise. We evaluate AHLERT on public CTI reports for well-known APTs across multiple proprietary and open-weight models. Hybrid evidence retrieval with ontology grounding raises mean F1 by ~2x (0.44 to 0.85) over a single-route flat-RAG baseline, and AHLERT attains the highest effectiveness score (~86.95%) compared with off-the-shelf LLM models.