Traditional RAG usually retrieves passages that are semantically close to a query. That is useful when the answer is contained in one or two documents. Cyber threat intelligence often asks a different question: how are an actor, a technique, an asset, an indicator and an incident related across many sources?
GraphRAG addresses this setting by extracting entities and relationships, organizing them into communities and using those structures during retrieval and synthesis.
1. From passages to a knowledge graph
Let be a graph where nodes represent entities and edges represent typed relationships. A query can retrieve a neighborhood, a community summary or a path:
The important object is not the graph alone. It is the path from an answer back to the source passages that justified each edge.
2. Global and local questions
A local query may ask which assets are associated with an indicator. A global query may ask how a campaign is organized across many reports. Plain vector retrieval can struggle with the second type because no single passage contains the complete pattern.
Community summaries help compress repeated structure, but they also introduce a new failure mode: a summary can flatten uncertainty or merge entities that only look similar.
3. Security-specific graph hygiene
The extraction layer should preserve:
- source and publication date,
- entity aliases and normalization decisions,
- relationship type and confidence,
- whether a relation is observed, reported or inferred,
- access restrictions and deletion requirements.
An inferred edge must never be presented as an observed fact. The graph should be versioned so that a changed extraction rule can be audited.
4. How to evaluate GraphRAG
Evaluate the graph and the answer separately. Measure entity resolution, relation precision, path validity, community coverage and the grounding of the final response. Include adversarial cases with misleading aliases, duplicated reports and contradictory timelines.
A useful inspection artifact is a claim graph: each answer claim points to the retrieved path and to the source documents. This gives the analyst a way to challenge the reasoning rather than trusting a polished paragraph.
GraphRAG is most valuable when the question is relational or global. It is not automatically better than a well-tuned passage retriever for every query.
This note is an original synthesis of graph-based retrieval for threat intelligence.
