Cyber Intelligence GraphRAGs for Behavioral Detection

Defenders increasingly face behaviorally driven adversary operations that evade indicator-based detection. Threat hunting offers a proactive alternative, but its effectiveness is bound by the quality of the initial hypothesis, which is limited by the analyst's capacity to synthesize a growing volume of cyber threat intelligence (CTI).

This paper introduces chatAPT, a prototype graphRAG system that extends a hybrid dual-retrieval architecture with domain-contextualized extraction, ontologies, and entity alignment, and exposes tools that enable human analysts and AI agents to query enriched threat intelligence during hypothesis generation.