Ais1on/CTI-RAG

CTI-RAG is a Retrieval-Augmented Generation (RAG) framework for Cyber Threat Intelligence (CTI), integrating knowledge graph and causal reasoning capabilities to provide security analysts with an intelligent threat intelligence analysis tool.

What it solves

ThreatRAG is designed for Cyber Threat Intelligence (CTI) analysis. It solves the limitation of standard RAG systems that only return similar text snippets by enabling security analysts to perform traceable, multi-hop analysis across entities like attack organizations, malware, vulnerabilities, infrastructure, and attack activities.

How it works

The system combines several retrieval and processing layers to provide comprehensive intelligence:

  • Hybrid Retrieval: It integrates vector search (via Milvus), knowledge graph queries (via Neo4j), query rewriting, and reranking to provide both structured relationship data and textual evidence.
  • Knowledge Graph Construction: It extracts entities and relationships from CTI text to build a queryable graph structure, allowing for complex relationship queries (e.g., "which vulnerabilities did a specific attack group use").
  • Multi-Model Routing: It supports a flexible routing system for LLMs (OpenAI, DeepSeek, Ollama, etc.) with fallback chains and circuit breakers to ensure high availability.
  • Asynchronous Processing: Heavy tasks like entity extraction and indexing are handled by a dedicated worker (threatrag-worker) using RabbitMQ for task queuing.
  • Session Management: User conversations are persisted in MySQL and cached in Redis for efficient state management.

Who it’s for

Cybersecurity analysts who need to analyze threat reports and perform complex relationship mapping between threat actors and their tactics, techniques, and procedures (TTPs).

Highlights

  • Multi-hop Analysis: Moves beyond simple similarity search to explore deep relationships between threat entities.
  • Enterprise-grade Infra: Includes a full stack of production-ready components: Milvus, Neo4j, RabbitMQ, Redis, and MySQL.
  • Resilient Model Routing: Built-in fallback mechanisms and circuit breakers for switching between cloud and local (Ollama) models.
  • Automated Graph Indexing: Tools to batch-convert threat reports into structured graph data.