Security Operations Center (SoC) analysts gather threat reports from openly accessible global threat databases and customize them manually to suit a particular organization's needs. These analysts also depend on internal repositories, which act as private local knowledge database for an organization. Credible cyber intelligence, critical operational details, and relevant organizational information are all stored in these local knowledge databases. Analysts undertake a labor intensive task utilizing these global and local knowledge databases to manually create organization's unique threat response and mitigation strategies. Recently, Large Language Models (LLMs) have shown the capability to efficiently process large diverse knowledge sources. We leverage this ability to process global and local knowledge databases to automate the generation of organization-specific threat intelligence. In this work, we present LOCALINTEL, a novel automated knowledge contextualization system that, upon prompting, retrieves threat reports from the global threat repositories and uses its local knowledge database to contextualize them for a specific organization. LOCALINTEL comprises of three key phases: global threat intelligence retrieval, local knowledge retrieval, and contextualized completion generation. The former retrieves intelligence from global threat repositories, while the second retrieves pertinent knowledge from the local knowledge database. Finally, the fusion of these knowledge sources is orchestrated through a generator to produce a contextualized completion.

翻译：安全运营中心（SoC）分析师从公开可访问的全球威胁数据库中收集威胁报告，并根据特定组织的需求手动定制这些报告。这些分析师还依赖内部存储库，这些存储库作为组织的私有本地知识数据库。可信的网络情报、关键运营细节以及相关组织信息都存储在这些本地知识数据库中。分析师需要承担繁重的工作，利用这些全球和本地知识数据库手动创建组织独特的威胁响应和缓解策略。近年来，大型语言模型（LLMs）已展现出高效处理多样化大规模知识源的能力。我们利用这一能力处理全球和本地知识数据库，以自动化生成针对特定组织的威胁情报。在本工作中，我们提出LOCALINTEL，一种新颖的自动知识情境化系统，该系统在收到提示后，从全球威胁存储库中检索威胁报告，并利用其本地知识数据库为特定组织进行情境化处理。LOCALINTEL包含三个关键阶段：全球威胁情报检索、本地知识检索和情境化完成生成。前一阶段从全球威胁存储库中检索情报，第二阶段从本地知识数据库中检索相关知识。最后，这些知识源的融合通过生成器协调，以生成情境化完成结果。