Traditional RAG usually retrieves passages that are semantically close to a query. That is useful when the answer is contained in one or two documents. Cyber threat intelligence often asks a different question: how are an actor, a technique, an asset, an indicator and an incident related across many sources?
GraphRAG addresses this setting by extracting entities and relationships, organizing them into communities and using those structures during retrieval and synthesis.
1. From passages to a knowledge graph
Let be a graph where nodes represent entities and edges represent typed relationships. A query can retrieve a neighborhood, a community summary or a path:
If the formula does not fit, focus it and use the left and right arrows, or scroll horizontally.The important object is not the graph alone. It is the path from an answer back to the source passages that justified each edge.
2. Global and local questions
A local query may ask which assets are associated with an indicator. A global query may ask how a campaign is organized across many reports. Plain vector retrieval can struggle with the second type because no single passage contains the complete pattern.
Community summaries help compress repeated structure, but they also introduce a new failure mode: a summary can flatten uncertainty or merge entities that only look similar.
3. Security-specific graph hygiene
The extraction layer should preserve:
- source and publication date,
- entity aliases and normalization decisions,
- relationship type and confidence,
- whether a relation is observed, reported or inferred,
- access restrictions and deletion requirements.
An inferred edge must never be presented as an observed fact. The graph should be versioned so that a changed extraction rule can be audited.
4. How to evaluate GraphRAG
Evaluate the graph and the answer separately. Measure entity resolution, relation precision, path validity, community coverage and the grounding of the final response. Include adversarial cases with misleading aliases, duplicated reports and contradictory timelines.
A useful inspection artifact is a claim graph: each answer claim points to the retrieved path and to the source documents. This gives the analyst a way to challenge the reasoning rather than trusting a polished paragraph.
GraphRAG is most valuable when the question is relational or global. It is not automatically better than a well-tuned passage retriever for every query.
GraphRAG represents a family of retrieval decisions
Microsoft's indexing methods document extraction and community summaries. Distinguish that implementation from any system combining graphs with retrieval. Traversing an entity path and synthesizing a global summary are different operations requiring different evaluations.
As an illustrative example, two reports can mention the same domain at different dates. That does not establish ownership by the same actor on both occasions. A relationship should retain its validity interval, source and claim type. If the second report cites the first, there is no independent corroboration.
Design a graph that can be corrected
STIX 2.1 supports modeling threat-intelligence entities and relationships. A retrieval system can use that vocabulary as a reference without assuming that every inferred node represents a verified object.
Maintain dependencies from each summary to its documents. When attribution is corrected, invalidate affected relationships and summaries before answering new queries. An updated graph with stale summaries can still spread the error.
A comparison that justifies graph costs
Build groups of exact-identification, two-source relationship and global-synthesis questions. Compare lexical search, hybrid RAG and GraphRAG with explicit indexing and query budgets. Evaluate citations, false relationships, coverage and update time. The more complex system should improve the questions that motivated building it.
Expose the evidence path for each answer and allow partial answers when some edges lack support. The security RAG guide covers the basic pipeline, while golden sets help establish expectations by query type.
