Retrieval-augmented large language models for security incident analysis

A RAG-based security incident analysis system extracts indicators of attack from raw logs and reconstructs attack sequences through targeted query filtering and large language model semantic reasoning. Across 17 malware scenarios, Claude Sonnet 4 achieved an average recall of 94%, DeepSeek V3 achieved 89% with a per-analysis cost 15 times lower than Claude, and locally deployed Llama 3.1:70b achieved a recall of 81%. With enumeration prompts, step detection for multi-stage Active Directory attacks reached a precision of 100% and a recall of up to 96%.