# GenDFIR: Advancing Cyber Incident Timeline Analysis Through Retrieval Augmented Generation and Large Language Models

arXiv: https://arxiv.org/abs/2409.02572 · HTML: https://mlsanity.com/paper/2409.02572/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation.
- First posted on arXiv 4 Sep 2024.

## Placed in

- Retrieval-augmented generation / [Privacy and security of RAG](https://mlsanity.com/rag/privacy-and-security-of-rag/)

## Built on by (most cited first, 7 of 7)

- [Advanced Persistent Threats (APT) Attribution Using Deep Reinforcement Learning](https://mlsanity.com/paper/2410.11463/) (2024)
- [DFIR-Metric: A Benchmark Dataset for Evaluating Large Language Models in Digital Forensics and Incident Response](https://mlsanity.com/paper/2505.19973/) (2025)
- [AutoBnB-RAG: Enhancing Multi-Agent Incident Response with Retrieval-Augmented Generation](https://mlsanity.com/paper/2508.13118/) (2025)
- [A Robust Cross-Domain IDS using BiGRU-LSTM-Attention for Medical and Industrial IoT Security](https://mlsanity.com/paper/2508.12470/) (2025)
- [TxRay: Agentic Postmortem of Live Blockchain Attacks](https://mlsanity.com/paper/2602.01317/) (2026)
- [Automated Post-Incident Policy Gap Analysis via Threat-Informed Evidence Mapping using Large Language Models](https://mlsanity.com/paper/2601.03287/) (2026)
- [Semantic Layer Induction from Raw Telemetry via Hierarchical LLM and RAG Abstraction](https://mlsanity.com/paper/2609.19615/) (2026)

## Abstract (arXiv)

Cyber timeline analysis, or forensic timeline analysis, is crucial in Digital Forensics and Incident Response (DFIR). It examines artefacts and events particularly timestamps and metadata to detect anomalies, establish correlations, and reconstruct incident timelines. Traditional methods rely on structured artefacts, such as logs and filesystem metadata, using specialised tools for evidence identification and feature extraction. This paper introduces GenDFIR, a framework leveraging large language models (LLMs), specifically Llama 3.1 8B in zero shot mode, integrated with a Retrieval-Augmented Generation (RAG) agent. Incident data is preprocessed into a structured knowledge base, enabling the RAG agent to retrieve relevant events based on user prompts. The LLM interprets this context, offering semantic enrichment. Tested on synthetic data in a controlled environment, results demonstrate GenDFIR's reliability and robustness, showcasing LLMs potential to automate timeline analysis and advance threat detection.