How does the RAG-based approach using a knowledge graph generate responses to user queries?

When a user asks a question, the RAG-based system first converts the question into a Cypher query, Neo4j's native query language. It then executes that query against the Neo4j knowledge graph to retrieve relevant nodes and relationships for cybersecurity entities such as CVE, CWE, CAPEC, and ATT&CK. The query output is preprocessed so the most relevant structured data becomes context, and that context is fed into a large language model to synthesize a final response.

In the described RAG approach, a knowledge graph stores cybersecurity entities as nodes and the relationships among them as edges. When a user submits a question, the pipeline has three main steps. First, it translates the user's natural language question into a Cypher query designed to traverse the graph. For example, a question about possible attacks related to a CWE is turned into a Cypher query that matches paths from the CWE node through CWE_CAPEC, CAPEC_CHILD or CAN_PRECEDE, and CAPEC_ATTACK relationships to attack nodes. Second, the query is executed on the Neo4j knowledge graph, where filters, relationship patterns, path-length limits, and ordering select the most relevant subgraph. Third, the retrieved output is cleaned and structured so that only the most relevant entities and relations are retained. This preprocessed structured information is then used as context for a large language model, which generates a coherent answer. Because the retriever works over a graph, it can follow multi-hop relationships and uncover connections that text-only retrieval systems often miss.