Cyber Threat Intelligence Report Generation Using Agentic AI

Abstract

Cyber Threat Intelligence (CTI) reports are instrumental communication tools for keeping decision makers and cybersecurity practitioners informed about the rapidly evolving cyberspace. However, the explosive growth of CTI sources has made ingestion, processing, and analysis for intelligence reporting increasingly difficult and error-prone. To address this, we introduce an end-to-end framework that ingests cybersecurity attack trends and streaming news, augmented with feeds from cybersecurity articles, into an agentic AI workflow. Further enhanced by a GraphRAG database and a vector database, this approach strengthens the capabilities of LLMs. The result is the generation of CTI analysis reports with high-quality and grounded data sources aimed at supporting and enhancing the decision-making process. We evaluate the system using custom grounding and consistency strategy, revealing strong performance when the workflow retrieves directly from RSS evidence and similarly high-quality synthesis when leveraging the knowledge graph.