AI-Powered Threat Intelligence Through Retrieval-Augmented Generation and Continuous Security Analytics for Modern Enterprises

Abstract

Modern enterprises generate vast volumes of cybersecurity telemetry from endpoints, networks, cloud platforms, applications, identity systems, security tools, and external threat intelligence sources. The increasing scale and heterogeneity of this information make it difficult for conventional security operations to rapidly transform fragmented observations into actionable threat intelligence. This research proposes an AI-powered threat intelligence framework that integrates Retrieval-Augmented Generation (RAG) with continuous security analytics to improve threat identification, contextual investigation, and response across modern enterprise environments. The proposed framework combines security information and event management data, endpoint telemetry, network indicators, vulnerability information, threat intelligence feeds, incident reports, and organizational knowledge within a continuously updated retrieval architecture. RAG enables an analytical language model to retrieve relevant and current evidence before generating threat intelligence, thereby reducing dependence on static model knowledge and improving contextual grounding. Continuous security analytics monitors incoming events, correlates related activities, identifies anomalous behavior, enriches indicators, and provides contextual explanations for detected threats. The methodology incorporates data preprocessing, embedding generation, vector-based retrieval, hybrid search, threat correlation, AI-assisted reasoning, confidence assessment, and continuous feedback. Evaluation can measure detection accuracy, retrieval precision, response time, false-positive reduction, contextual relevance, explanation quality, and analyst workload. The proposed approach provides a scalable foundation for integrating generative AI withenterprise security operations while maintaining evidence-based analysis, auditability, and controlled human oversight.