Threat-intelligence RAG has to retrieve hostile content without allowing that content to control the system.
Threat intelligence is a difficult retrieval domain. Sources are duplicated, contradictory, time-sensitive, adversarial, and full of identifiers that change meaning by context.
NIST defines RAG as pairing a model with a separate retrieval system that supplies relevant knowledge in context. In cyber intelligence, that context must remain evidence, not instruction.
Build an ingestion trust boundary.
Store the original source and derive normalized records. Capture URL or provider, collection time, publication time, author, license, language, hash, sensitivity, and parser version.
Scan content, but assume malicious instructions can remain. Preserve raw data outside the prompt path and mark all extracted text as untrusted.
Retrieve through permissions first.
Resolve tenant, principal, case, region, and data entitlements before search. Apply filters inside each lexical, vector, graph, and structured query. Never retrieve globally and filter the final list.
Use hybrid retrieval:
- lexical search for exact indicators and names;
- semantic search for concepts and campaigns;
- graph traversal for entities and relationships;
- structured queries for time, confidence, and source.
Separate evidence from instructions.
Package retrieved passages in a typed envelope with source IDs and explicit delimiters. The system prompt should state that source content cannot change policy or tool permissions, but prompts are not the primary defense.
Enforce controls outside the model:
- tools use validated schemas;
- credentials are scoped;
- actions pass policy;
- high-risk effects require approval;
- retrieved text cannot select tools or tenants directly.
OWASP identifies indirect prompt injection as malicious instructions embedded in external content later processed by a model. Threat-intelligence systems should expect this condition, not treat it as an edge case.
Model time and contradiction.
An IOC can expire. A domain can change ownership. Two vendors can disagree. Store validity windows, confidence, source independence, and contradiction links.
Require generated claims to cite evidence. Show conflicting sources rather than forcing false consensus. The evidence-layer architecture describes the broader provenance model.
Evaluate retrieval and generation separately.
For retrieval, measure relevant evidence found, irrelevant evidence included, freshness, permission correctness, and source diversity.
For generation, measure claim support, citation accuracy, entity consistency, calibration, abstention, and action safety.
Add adversarial cases with poisoned pages, hidden instructions, identifier collisions, stale reports, and cross-tenant near-neighbors.
Keep a reproducible research record.
Store the query plan, retrieved evidence IDs and versions, model and prompt version, claims, citations, analyst edits, and final disposition. Another analyst should be able to reconstruct why the system reached a conclusion.
Secure threat-intelligence RAG is not "chat with a vector database." It is a permissioned evidence pipeline designed to reason over contested information without surrendering control to it.