LLM agents and SOC: developers built a cyber threat database using RAG

Developers shared on Habr how they built their own cybersecurity threat database for LLM agents and SOC systems: the service combines PDF documents, CVE records, and cybersecurity articles in one database and provides relevant fragments to an AI agent through an HTTP API.

How the pipeline database is structured

Initially, the task looked linear and fit into one sequence of steps. Sources — PDF files, CVE vulnerability descriptions, and information security articles — are first uploaded to the system, then text is extracted from them.

• Data sources — PDF documents, CVE records, and cybersecurity articles
• Text is split into fragments (chunking) for subsequent indexing
• Vectorized representations (embeddings) are built from fragments for semantic search
• The finished database returns results to the LLM agent through an HTTP API
• Authors assembled a working prototype quickly — the real work began after its launch

After text extraction, the system splits documents into chunks, builds vectorized representations from them, and turns it all into a search index from which an LLM agent or SOC analyst receives context for a specific threat.

Why a prototype is only the beginning

According to the authors, a working prototype appeared quickly, and the real work started afterward. This is a typical situation for knowledge bases based on RAG (retrieval-augmented generation) in narrow specialized domains like cybersecurity: assembling a basic chain from upload, text extraction, chunking, vectorization, and search can be done in a short time, but turning it into a source that an LLM agent and SOC analyst actually trust — is a task of a completely different scale.

An additional complexity in such a domain is the heterogeneity of formats: PDF threat reports, structured CVE records, and regular security articles are structured differently and require different approaches to text extraction and fragmentation before it can all be brought into a unified search index.

Why this is needed for LLM agents and SOC

The idea is to give the LLM agent not general knowledge from the training dataset, but current, verifiable fragments from PDF reports, CVE records, and security articles through an HTTP API. For a SOC (Security Operations Center) analyst, this means the model's response to a specific threat is based on a real source, not just what the model "remembers" from pretraining — an approach commonly called retrieval-augmented generation, or RAG.

This is why the authors describe the path not as a one-time development, but as an ongoing process: the cybersecurity threat database should be continuously updated with new CVEs and articles, which means the loading, chunking, and search pipeline needs to be maintained and refined even after the first version begins answering queries.

The five-step scheme — upload, text extraction, chunking, vector building, search — is typical for modern RAG systems and fits into an understandable linear logic that is easy to describe on a whiteboard. This is exactly the simple version of the pipeline the authors assembled first before moving to the more labor-intensive refinement stage.

What this means

The case shows a typical path for building RAG systems for narrow professional domains: a working pipeline for uploading, chunking, and vector search can be assembled quickly, but turning it into a tool that LLM agents and SOC analysts actually trust — is a task that truly begins only after the first prototype.