Leveraging Large Language Models (LLMs) for Automated Cyber Threat Intelligence Analysis and Incident Response: A Comprehensive Review

Abstract

Modern Security Operations Centers (SOCs) operate in an increasingly aggressive cyber threat environment marked by rapid telemetry growth, sophisticated multi-stage attacks, and a critical shortage of experienced security analysts. Traditional Automated Cyber Threat Intelligence (CTI) parsing frameworks and Security Orchestration, Automation, and Response (SOAR) platforms rely heavily on rigid rule-based pattern matching and regular expressions. Consequently, security analysts experience intense alert fatigue, high rates of false positives, and delayed response timelines. Large Language Models (LLMs) represent a transformative paradigm capable of interpreting unstructured threat intelligence feeds, extracting Indicators of Compromise (IoCs), mapping adversary TTPs to the MITRE ATT&CK framework, and synthesizing context-aware incident response playbooks in near real time. This review paper provides a rigorous evaluation of LLM integration across CTI analysis and incident response workflows. We examine core deployment methodologies including Retrieval-Augmented Generation (RAG), domain-specific parameter-efficient fine-tuning (e.g., SecureBERT, LoRA-adapted open weights), and autonomous multi-agent orchestration systems. Furthermore, we analyze empirical performance metrics across CTI extraction accuracy, MITRE ATT&CK classification precision, and Mean Time to Respond (MTTR) reduction. Crucially, this study addresses major technical challenges, including hallucination vulnerabilities, indirect prompt injection risks, enterprise telemetry data privacy, and execution safety guardrails in autonomous remediation. Finally, we establish a tactical research agenda to guide future developments toward robust, privacy preserving, and formally verifiable AI-driven cybersecurity defense ecosystems.

KEYWORDS: Cyber Threat Intelligence (CTI); Large Language Models (LLMs); Incident Response; Security Operations Center (SOC); Retrieval Augmented Generation (RAG); MITRE ATT&CK; Autonomous Remediation; Security Orchestration.