Back to Paper
cs.CRcs.AI
Local ID: 2603.18196v3
AI Summary: gemma4:e4b
Retrieval-Augmented LLMs for Security Incident Analysis
By Xavier Cadet, Aditya Vikram Singh, Harsh Mamania, Edward Koh, Alex Fitts, Dirk Van Bruggen, Simona Boboila, Peter Chin, Alina Oprea
Revision History Timeline
v13/18/2026
3/18/2026
No submitter comment provided.
v23/20/2026
3/20/2026
No submitter comment provided.
v35/4/2026
5/4/2026
“In ACM Conference on AI and Agentic Systems, CAIS 2026, San Jose, CA, USA”
★ Version indexed in ExplorerComparing v2 vs v3
Green = Added • Red = Removed
Title Comparison
Retrieval-Augmented LLMs for Security Incident Analysis
Authors Comparison
No author changes.
v2 Comment
No comment for this version.
v3 Comment
“In ACM Conference on AI and Agentic Systems, CAIS 2026, San Jose, CA, USA”
Abstract Word Diff
Investigating cybersecurity incidents requires collecting and analyzing evidence from multiple log sources, including intrusion detection alerts, network traffic records, and authentication events. This process is labor-intensive: analysts must sift through large volumes of data to identify relevant indicators and piece together what happened. We present a RAG-based system that performs security incident analysis through targeted query-based filtering and LLM semantic reasoning. The system uses a query library with associated MITRE ATT&CK techniques to extract indicators from raw logs, then retrieves relevant context to answer forensic questions and reconstruct attack sequences. We evaluate the system with fiveeight LLM providersconfigurations on malware traffic incidents and a multi-stage Active Directory attacks.attack. We find that LLM modelsLLMs have different performance and tradeoffs, with Claude Sonnet 4 achieving 94% and DeepSeek V3 achieving 100%89% average recall across all four17 malware scenarios, while DeepSeek costs 15 times15$\times$ less ($0.008 vs.than $0.12Claude per analysis). Attack step detection on Active Directory scenarios reaches 100% precisionanalysis, and 82% recall.locally-deployed AblationLlama studies3.1:70b confirmachieves that81% arecall RAGat architecturezero isper-query essential:cost. LLMAttack baselinesstep withoutdetection RAG-enhancedon contextthe correctlyActive identifyDirectory victimscenario hostsreaches but100% missprecision alland attackup infrastructureto including96% maliciousrecall domainswith andan command-and-controlenumeration servers.prompt. These results demonstrate that combining targeted query-based filtering with RAG-based retrieval -- confirmed essential by ablation studies -- enables accurate, cost-effective security analysis within LLM context limits.