Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
To automate the translation of unstructured cyber threat intelligence into operational hypotheses, the authors developed AHLERT, a retrieval-augmented generation framework that couples dense retrieval with multi-hop knowledge graph traversal over MITRE ATT&CK. Traditional automated extraction yields disconnected, entity-level indicators without operational context, failing to account for defender-specific assets and telemetry. By enforcing ontology-grounded generation against the defender's environment, the system nearly doubles mean F1 from 0.44 to 0.85 over standard flat-RAG baselines, reaching an 86.95% effectiveness score across diverse proprietary and open-weight LLMs.
Standard RAG collapses when mapping raw threat reports to enterprise defenses, but fusing MITRE ATT&CK knowledge graphs with defender ontology constraints doubles actionable hunt lead generation to an 0.85 F1.
Threat hunting increasingly depends on converting unstructured knowledge (e.g., Cyber Threat Intelligence reports) into actionable hunt leads: concise, investigable hypotheses grounded in observable artifacts and adversary techniques. Producing such leads manually is a tedious and hard-to-scale task. Existing automated approaches stop at the entity layer, ignore the defender's operational environment, and analyze each report in isolation. To address these gaps, we introduce AHLERT, a system that automatically extracts relevant, environment-aware, and hunt leads from threat reports through (i) a hybrid retriever that combines dense vector search with multi-hop traversal over a knowledge graph seeded with MITRE ATT&CK; (ii) an ontology-grounding retrieval-augmented generation method that constrains each lead to the defender's own assets and controls; and (iii) an LLM-agnostic framework that emits structured, directly actionable leads rather than loose indicators of compromise. We evaluate AHLERT on public CTI reports for well-known APTs across multiple proprietary and open-weight models. Hybrid evidence retrieval with ontology grounding raises mean F1 by ~2x (0.44 to 0.85) over a single-route flat-RAG baseline, and AHLERT attains the highest effectiveness score (~86.95%) compared with off-the-shelf LLM models.