Retrieval augmented generation for security operations
Abstract
Security Operations Centre (SOC) engineers face several challenges configuring Security Information and Event Management (SIEM) systems for log parsing. Heterogeneous log formats and fragmented vendor documentation necessitate manual authorship of regular expressions, which take up effort and long man hours. However, existing commercial generative AI assistants exhibit hallucination, generating plausible but functionally incorrect parsing rules. In contrast, we present a decomposed Retrieval Augmented Generation (RAG) framework engineered to automate SIEM log parsing configuration whilst mitigating hallucination by explicit documentation grounding. The system introduces two principal contributions: (1) hybrid retrieval fusing BM25 lexical search with dense vector retrieval via Reciprocal Rank Fusion, and (2) staged regex generation employing repetitive refinement and validation. The architecture was implemented as a containerised microservice system supporting air-gapped deployment, incorporating MongoDB Atlas for unified storage, and providing human-in-the-loop review workflows. Evaluation employed 182 synthetic queries for retrieval assessment and 100 manually curated regex patterns for generation quality measurement. Empirical findings demonstrate that hybrid retrieval achieved 0.81 contextual precision (12.5% improvement over lexical-only) and 0.89 recall. The decomposed generation approach attained 0.46 functional accuracy, representing 24.3% improvement over…
Read the paper
Related studies
- Knowledge Management Perspective of Generative Artificial Intelligence
- Navigating Generative Artificial Intelligence Promises and Perils for Knowledge and Creative Work
- Characterizing the evolving research on enterprise content management
- Large language models and multimodal foundation models for precision oncology
- From Generative AI to Extended Reality: Multidisciplinary Perspectives on the Challenges, Opportunities, and Future of Educational Computing
- Generative Artificial Intelligence: A New Engine for Advancing Environmental Science and Engineering
Go deeper in Evidence Hub
Evidence Hub adds a study data sheet (design, sample size, evidence level, key numbers), an AI summary and a chat grounded in the paper's text.