RAGSec: Retrieval-Augmented Generation for Cybersecurity Threat Intelligence in Enterprise Networks

Security operations centers (SOCs) are inundated with high-volume, high-velocity threat intelligence originating from SIEM platforms, IDS/IPS alerts, vendor advisories, malware reports, and dark-web monitoring tools [6], [7]. While recent studies explore retrieval-augmented generation (RAG) for cybersecurity, existing approaches (e.g., RAGRecon [1], CyKG-RAG [2], MoRSE [3]) are primarily research prototypes and rarely address enterprise deployment constraints such as incident-severity governance, policy-aligned hallucination control, or SOC-driven evaluation metrics [5]. Large Language Models (LLMs) offer promising summarization and reasoning capabilities, but when applied directly they hallucinate indicators, lack grounding in enterprise context [7], and provide limited auditability for regulated environments [6].This paper introduces RAGSec, a RAG-based threat intelligence framework that operationalizes retrieval-augmented generation specifically for enterprise networks. Unlike prior work, RAGSec integrates (i) sensitivity-scoped ingestion pipelines for heterogeneous security sources, (ii) retrieval-confidence thresholds tied to incident severity levels, (iii) abstention and evidence-citation templates aligned to SOC governance policies, and (iv) an SOC Productivity Score (SPS) for measuring analyst impact beyond factuality metrics [6]. Using a blend of public reports and synthetic enterprise incidents, RAGSec is evaluated against LLM-only and search-assisted baselines across factuality, relevance, completeness, and analyst workload [6].Results show that RAGSec improves factual accuracy by up to 32% and reduces unsupported statements by 41% compared to LLM-only baselines [7], while reducing incident triage time by 27%. These findings indicate that domain-governed RAG pipelines can meaningfully augment analyst decision-making without compromising control or auditability [5]. We conclude with limitations, ethical considerations, and recommendations for deploying retrieval-enhanced GenAI within live SOC environments.