Graph-Augmented LLMs for SIEM: finding multi-stage attacks and explaining them

TL;DR#

• Traditional SIEMs catch what they already know, but miss slow multi-stage attacks and bury analysts in alerts.
• GA-LLM pairs a graph neural network, which spots unusual behavior, with an LLM that explains it in plain language, mapped to MITRE ATT&CK.
• In tests it matched or beat earlier methods (F1 of 0.97 on CADETS) and cut log volume by about 96.5% while keeping more than 99% of attack events.
• The results come from research datasets, not live production, so read them as strong early evidence.

The problem: too many alerts, too little context#

The paper starts with the scale analysts face. Citing Vectra AI's 2023 report, it says the average SOC analyst receives 4,484 alerts a day and ignores about 67% of them.

Rule-based systems also cannot reason about relationships, so they struggle with attacks that unfold in stages: reconnaissance, lateral movement, privilege escalation, persistence and data theft. Each step can look harmless on its own. The pattern only shows up when you connect events across users, hosts, processes and time.

Earlier approaches each fix part of this. Machine learning finds statistical oddities, but unusual is not the same as malicious. Graph methods capture relationships but cannot explain themselves in plain words. Language models explain well but struggle with raw telemetry volume and can hallucinate. The paper's argument is that no existing system combines all three strengths in one scalable design.

The idea: a map and a translator#

GA-LLM treats an environment as a graph. Users, devices and applications are the points, and logins, access and network traffic are the lines between them. A graph neural network learns what normal looks like on that map and flags points and connections that deviate. A language model then does what the graph cannot: it reads the suspicious cluster, explains what is going on, and ties it to the MITRE ATT&CK framework

How it works#

1. Build the graph. Telemetry from network devices, endpoints, cloud platforms and authentication systems is cleaned, normalized and turned into a live interaction graph.
2. Flag what is unusual. Graph models compare current behavior with learned normal patterns and score anomalies. Suspicious entities are grouped into clusters.
3. Add outside knowledge. For each cluster, a GraphRAG step pulls similar past attack patterns from a MITRE ATT&CK knowledge graph, so the language model works from retrieved facts instead of guessing.
4. Explain and check. The model reasons in steps (what deviates, what the timing and cause-and-effect look like, which ATT&CK techniques match) and returns a structured result with a confidence score, a summary and indicators of compromise. A validation layer checks that output against a schema before anything becomes an alert.
5. Triage and learn. High-confidence findings raise an alert. Borderline ones are held and correlated across later time windows. Analyst feedback flows back into the system, and benign activity is pruned from the graph to keep it manageable.

What the results show#

The framework was tested on the DARPA Transparent Computing datasets (CADETS and THEIA), Public Arena and Blind Eagle red-team logs, plus a corpus of more than 4.2 million Windows events. On CADETS, it compared like this with earlier methods:

Other highlights from the paper:

• On THEIA, F1 reached 0.94 against 0.63 for SHIELD. Public Arena and Blind Eagle scored about 0.92 each.
• Mapping to ATT&CK reached a micro-F1 of 0.743, 14 to 18 points above the baselines, and analysts rated the explanations 4.7 out of 5.
• Log volume dropped by 95.8 to 96.5 percent while more than 99 percent of attack-related events were kept.

Two caveats the paper is open about. SHIELD kept slightly higher precision on CADETS (1.00 against 0.98), so the gain there is in recall and overall F1, not in fewer false alarms. And the results come from research datasets, not live production environments.

What comes next#

The authors list five directions: federated learning across multi-tenant cloud environments, learning from analyst feedback, lightweight deployments of smaller models at the edge, defenses against prompt injection and graph poisoning, and integration with threat intelligence feeds such as MISP and STIX/TAXII.

The takeaway#

The point of the paper is that detection and explanation do not have to be separate jobs. A graph finds the needle, and a language model says what it is, why it matters and what to do, while cutting the log volume analysts wade through by more than 95 percent in testing. Read the full paper for the architecture, algorithms and datasets.

Sources#

• Kiran P, R., Rebello, M. W. and Raghunathan, G., "Graph-Augmented LLMs for SIEM: Explainable Attack Attribution with High-Fidelity Log Reduction," International Journal of Artificial Intelligence and Machine Learning, vol. 6, no. 13s, 2026, pp. 265 to 273, DOI 10.51483/IJAIML.6.13s.2026.265-273