LangGraph Architecture Combines Hybrid RAG with YARA and Sigma Engines for Streaming Log Analysis
A research team has developed an architectural pattern titled LangGraph, hybrid RAG + Signature Engine that creates a universal graph for processing streaming data, demonstrated on cybersecurity logs but designed to be modular for other text analysis tasks.
Architecture Overview
Logs are ingested by Vector with a Lua chunker producing 250-line segments and 20-line overlap, then published to a Kafka topic. An aiokafka consumer with retry logic and dead-letter queue forwards batches to an 8-node LangGraph DAG whose results are persisted in PostgreSQL.
The graph contains two parallel branches. The AI branch routes filtered logs through Agent 1 for event grouping and anomaly detection, Description Agent for natural-language summaries, and Agent 2 for hybrid RAG retrieval against MITRE ATT&CK. The deterministic branch parses logs and runs them through custom YARA and Sigma engines. All outputs converge at Agent 3, which produces the final report, validates hypotheses, and flags events requiring manual review.
Hybrid RAG Component
Agent 2 improves queries with an LLM, executes hybrid search combining vector similarity (weight 0.6) and BM25 (weight 0.4) over a Russian-translated MITRE ATT&CK collection in ChromaDB, then applies LLM re-ranking on the top-3 candidates. This approach reduces token usage while maintaining classification accuracy for techniques such as T1110 and T1190.
Deterministic Engines and Rule Generation
The YARA engine compiles .yar files and matches concatenated log fields using the native yara-python library. The Sigma engine parses YAML rules into selection conditions evaluated with contains, startswith, endswith, and regex operators. When RAG identifies an uncovered technique, Agent 3 triggers an LLM-based YARA rule generator that iterates up to three times with validation before storing the rule in a pending queue for analyst approval.
Performance and Metrics
On a 43-minute synthetic dataset of approximately 850 lines containing 38 ground-truth MITRE ATT&CK techniques, the pipeline recorded 85.7% precision, 78.9% recall, and an F1 score of 0.82 while processing 3.5 lines per second. The system was developed as part of a project practicum at UrFU and tested with Gemini 2.5 Flash.
Related articles
AI Coding Tools Under Fire: Grok Build Uploads Entire Git Histories, Claude Code Suspected of Silent Transfers
Security researcher cereblab uncovered that Grok Build 0.2.93 establishes separate HTTPS channels to exfiltrate full Git repositories, resulting in a 27800-fold traffic discrepancy between task context and storage uploads to Google Cloud Storage buckets. The tool ignores user instructions such as "do not read" and decouples the improve_model_enabled client switch from the server-controlled trace_upload_enabled flag, allowing continued uploads even when privacy settings are disabled. Similar concerns emerged around Claude Code, which maintains undisclosed WebSocket connections that transmit file paths, dependency trees, and code metadata without user awareness or audit logs. Comparative traffic audits showed that Codex and Gemini produced no anomalous outbound activity, while Grok Build and Claude Code were the only tools confirmed to perform data transfers beyond user authorization. The incidents highlight systemic issues including server-side remote control of client behavior, lack of third-party audits for closed-source binaries, and the conflict between model training data needs and user data sovereignty. Experts recommend zero-trust measures such as network blocking, Docker sandboxing without mounting .git directories, git filter-repo sanitization, and preference for auditable open-source alternatives like Continue.dev or locally deployed Ollama models.
PentesterFlow Launches Open-Source AI CLI Tool for Penetration Testers and Bug Bounty Hunters
PentesterFlow is a new open-source, human-in-the-loop AI command-line tool designed specifically for penetration testers and bug bounty hunters. It automates the full workflow from reconnaissance to report generation while requiring explicit analyst approval before executing sensitive commands. The tool addresses common issues in agentic AI security tools such as hallucinations, weak context retention, and poor tool integration by incorporating built-in pentesting skills and evidence-based vulnerability confirmation. It supports connections to local or hosted LLMs including Ollama, Gemini, Groq, and others, and features continuous local learning that stores user preferences and lessons without retraining models. A key differentiator is its integration with Burp Suite and a permission-based execution model that includes a YOLO mode for isolated environments. The project positions itself as a transparent alternative to fully autonomous tools like PentAGI and PentestGPT.
Optimizing Cybersecurity Content for LLMs: How Sites Can Enter Generative AI Answers
Search engines and AI services like ChatGPT, Gemini, Perplexity, Copilot and Google AI Overviews increasingly deliver synthesized answers instead of link lists. For cybersecurity publishers this changes competition because high traditional rankings no longer guarantee visibility or accurate citation. The article explains GEO, AEO and LLMO practices, shows how material moves through indexing, fragment selection and summarization stages, and stresses the need for self-contained facts that survive extraction and paraphrasing. It provides concrete writing frameworks for vulnerability reports, including required fields such as CVE identifiers, affected versions, attack conditions and real-world exploitation evidence. Technical requirements cover correct robots.txt handling for Googlebot, OAI-SearchBot, GPTBot and Bingbot plus the use of IndexNow for rapid updates. The piece also warns about poisoning risks, prompt injection and slopsquatting attacks that can feed false data into generative systems.
Local LLM Deployment for SOC: How Many Incidents Can One NVIDIA RTX PRO 6000 Handle?
In the second part of the experiment, R-Vision analysts tested the Qwen3.5-122B-A10B-GPTQ model running locally with vLLM on an NVIDIA RTX PRO 6000 Blackwell Max-Q GPU with 96 GB VRAM. The evaluation moved from synthetic stress tests to realistic SOC workloads using anonymized real incidents from their internal operations center. Tasks included incident ranking, summarization, similarity search, retrospective analysis, and preliminary verdict generation within the R-Vision SOAR orchestration pipeline. Two load scenarios were modeled: a calm shift with 10-15 incidents per hour handled by 3-5 L1/L2 analysts, and a peak scenario with 50-100 incidents arriving in a short period involving 5-7 analysts. Resources were split between a high-priority interactive chat pool and a lower-priority background SOAR pool using an AI Gateway layer to manage queues, context length, and KV-cache usage. Results showed that one GPU can process up to 5 incidents simultaneously in the background pipeline, delivering a theoretical maximum throughput of 300 incidents per hour under the tested conditions and prompt profiles.