Bridging Forecasts and Mitigation Through Retrieval-Augmented Time-Series Models for Cybersecurity Incidents

In Cyber Threat Intelligence, anticipating threat events and linking forecasts to standards-based mitigations is essential, yet many approaches rely on non-unified event representations within the analysis window, introducing bias and weakening tactical signal. In this manuscript, an end-to-end workflow is introduced that canonicalizes seven public threat feeds, constructs exogenous covariates, applies Elastic Net under Walk-Forward Cross-Validation (WFCV), and models continuous and intermittent series with SARIMAX and ADIDA estimators. Forecasts are consolidated into a fourteen-dimensional risk vector aligned with the MITRE ATT&CK framework taxonomy and translated into mitigations through a Retrieval-Augmented Generation (RAG) module that also consults the CISA Known Exploited Vulnerabilities catalogue. At a seven-day forecast horizon h=7 with weekly seasonality m=7, forecasting attains MAPE 12.0%, RMSE 6.8, and MAE 4.9. Mitigation retrieval, evaluated on 73 tactic-specific contextual queries from the test set, achieves 84.5% Exact Match and 91.3% Coverage.