Security Operations Center (SoC) analysts gather threat reports from openly
accessible global threat databases and customize them manually to suit a
particular organization's needs. These analysts also depend on internal
repositories, which act as private local knowledge database for an
organization. Credible cyber intelligence, critical operational details, and
relevant organizational information are all stored in these local knowledge
databases. Analysts undertake a labor intensive task utilizing these global and
local knowledge databases to manually create organization's unique threat
response and mitigation strategies. Recently, Large Language Models (LLMs) have
shown the capability to efficiently process large diverse knowledge sources. We
leverage this ability to process global and local knowledge databases to
automate the generation of organization-specific threat intelligence.
In this work, we present LOCALINTEL, a novel automated knowledge
contextualization system that, upon prompting, retrieves threat reports from
the global threat repositories and uses its local knowledge database to
contextualize them for a specific organization. LOCALINTEL comprises of three
key phases: global threat intelligence retrieval, local knowledge retrieval,
and contextualized completion generation. The former retrieves intelligence
from global threat repositories, while the second retrieves pertinent knowledge
from the local knowledge database. Finally, the fusion of these knowledge
sources is orchestrated through a generator to produce a contextualized
completion.

LOCALINTEL 是一种自动化知识情境化系统，通过从全球威胁存储库检索威胁报告并使用本地知识数据库对其进行情境化，实现特定组织的威胁情报自动生成。