Using LLMs to Automate Threat Intelligence Analysis Workflows in Security Operation Centers
Not on the map. Why?
Abstract (arXiv)
SIEM systems are prevalent and play a critical role in a variety of analyst workflows in Security Operation Centers. However, modern SIEMs face a big challenge: they still cannot relieve analysts from the repetitive tasks involved in analyzing CTI (Cyber Threat Intelligence) reports written in natural languages. This project aims to develop an AI agent to replace the labor intensive repetitive tasks involved in analyzing CTI reports. The agent exploits the revolutionary capabilities of LLMs (e.g., GPT-4), but it does not require any human intervention.
Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). First posted on arXiv 18 Jul 2024.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2024: 1; 2025: 5; 2026: 4.
10 papers.
- 2024Divide-Verify-Refine: Can LLMs Self-Align with Complex Instructions?cited by 7
- 2025Advancing Autonomous Incident Response: Leveraging LLMs and Cyber Threat Intelligencecited by 6
- 2025RulePilot: An LLM-Powered Agent for Security Rule Generationcited by 4
- 2026Retrieval-Augmented LLMs for Security Incident Analysiscited by 4
- 2025From Texts to Shields: Convergence of Large Language Models and Cybersecuritycited by 3
- 2025REx86: A Local Large Language Model for Assisting in x86 Assembly Reverse Engineeringcited by 1
- 2025Large Language Models in Cybersecurity: Applications, Vulnerabilities, and Defense Techniquescited by 0
- 2026Policy-Guided Threat Hunting: An LLM enabled Framework with Splunk SOC Triagecited by 0
- 2026Tug-of-War within A Decade: Conflict Resolution in Vulnerability Analysis via Teacher-Guided Retrieval-Augmented Generationscited by 0
- 2026From Chasing Ghosts to Missed Attacks: Perspectives and Perceptions of SOC Practitioners on LLM Integration, Risks, and Readinesscited by 0
- 2026From Chasing Ghosts to Missed Attacks: Perspectives and Perceptions of SOC Practitioners on LLM Integration, Risks, and Readiness1 Aug 2026
- 2026Tug-of-War within A Decade: Conflict Resolution in Vulnerability Analysis via Teacher-Guided Retrieval-Augmented Generations25 Mar 2026
- 2026Policy-Guided Threat Hunting: An LLM enabled Framework with Splunk SOC Triage25 Mar 2026
- 2026Retrieval-Augmented LLMs for Security Incident Analysis18 Mar 2026
- 2025RulePilot: An LLM-Powered Agent for Security Rule Generation15 Nov 2025
- 2025REx86: A Local Large Language Model for Assisting in x86 Assembly Reverse Engineering23 Oct 2025
- 2025Advancing Autonomous Incident Response: Leveraging LLMs and Cyber Threat Intelligence14 Aug 2025
- 2025Large Language Models in Cybersecurity: Applications, Vulnerabilities, and Defense Techniques18 Jul 2025
- 2025From Texts to Shields: Convergence of Large Language Models and Cybersecurity1 May 2025
- 2024Divide-Verify-Refine: Can LLMs Self-Align with Complex Instructions?16 Oct 2024