System improves cyber threat investigation by generating actionable leads
Evidence-Grounded Retrieval for Investigation Hunt Lead Generation from CTI Reports
Cryptography and SecurityArtificial Intelligence
Summary
Investigating cyber threats requires turning long, detailed reports into clear clues that defenders can act on. The authors created a system called AHLERT that automatically pulls out useful, environment-specific clues from threat reports. It uses a mix of smart search with knowledge graphs and limits results to what matches the defender's own systems. Their system works better than previous methods and off-the-shelf language models by providing more accurate and focused information to help defenders hunt for threats. This means cybersecurity teams can work faster and more effectively without sifting through lots of unrelated data.
Cyber Threat IntelligenceThreat huntingMITRE ATT&CKKnowledge graphDense vector searchRetrieval-augmented generationOntology groundingLarge language modelsInvestigable hypothesesIndicators of compromise
Authors
Akash Prakash, Boubakr Nour, Makan Pourzandi, Chadi Assi, Mourad Debbabi
Abstract
Threat hunting increasingly depends on converting unstructured knowledge (e.g., Cyber Threat Intelligence reports) into actionable hunt leads: concise, investigable hypotheses grounded in observable artifacts and adversary techniques. Producing such leads manually is a tedious and hard-to-scale task. Existing automated approaches stop at the entity layer, ignore the defender's operational environment, and analyze each report in isolation. To address these gaps, we introduce AHLERT, a system that automatically extracts relevant, environment-aware, and hunt leads from threat reports through (i) a hybrid retriever that combines dense vector search with multi-hop traversal over a knowledge graph seeded with MITRE ATT&CK; (ii) an ontology-grounding retrieval-augmented generation method that constrains each lead to the defender's own assets and controls; and (iii) an LLM-agnostic framework that emits structured, directly actionable leads rather than loose indicators of compromise. We evaluate AHLERT on public CTI reports for well-known APTs across multiple proprietary and open-weight models. Hybrid evidence retrieval with ontology grounding raises mean F1 by ~2x (0.44 to 0.85) over a single-route flat-RAG baseline, and AHLERT attains the highest effectiveness score (~86.95%) compared with off-the-shelf LLM models.