Using LLM Agents for Data Integration in Cybersecurity Incidents

Madrueño, N.; Rueda, J.; García-Ochoa, J.; Fernández-Isabel, A.; Martín de Diego, I.; Romy R. Ravines

doi:10.1007/978-3-032-10486-1_33

Using LLM Agents for Data Integration in Cybersecurity Incidents

Intelligent Data Engineering and Automated Learning – IDEAL 2025

Conference Paper

Authors

Madrueño, N.

Rueda, J.

García-Ochoa, J.

Fernández-Isabel, A.

Martín de Diego, I.

Romy R. Ravines

Published

November 6, 2025

Pdf BibTeX

Abstract

Organizations across all sectors face a growing number of cyber incidents that can jeopardize their financial stability, reputation, and operational resilience. Understanding the evolving landscape of these incidents requires not only identifying the targeted organizations, but also contextualizing them within their broader business and geopolitical environments. This study proposes a novel multi-agent system designed to automate the extraction and integration of firmographic data for organizations affected by real-world cyber incidents. The system is based on a multi-agent workflow provided by LangGraph, where each stage processes and forwards intermediate results, thereby enabling a pipeline in which the information is progressively enriched. Ultimately, the outputs are aggregated to generate a single coherent response. The agents extract basic information about the victim, identify their website, and enrich their profile using external data sources, including Google, RocketReach, DBpedia, and BigPicture. The system was tested with real cyber incidents that impacted companies, as reported by Industrial Control System Security, Threats, Regulations, Incidents, Vulnerabilities provided by Experts (ICS STRIVE) and European Repository of Cyber Incidents (EuRepoC), demonstrating its ability to extract victim names and retrieve firmographic attributes with high completeness and confidence. This automatic profiling approach provides valuable input for cyber threat intelligence and enables more informed decision-making when analyzing attackers’ motivations and risk exposure.

Citation

BibTeX citation:

@inproceedings{n.2025,
  author = {N. , Madrueño and J. , Rueda and J. , García-Ochoa and A. ,
    Fernández-Isabel and de Diego, I., Martín and R. Ravines, Romy},
  title = {Using {LLM} {Agents} for {Data} {Integration} in
    {Cybersecurity} {Incidents}},
  booktitle = {Intelligent Data Engineering and Automated Learning –
    IDEAL 2025},
  volume = {16238},
  pages = {358–370},
  date = {2025-11-06},
  url = {https://link.springer.com/chapter/10.1007/978-3-032-10486-1_33},
  doi = {10.1007/978-3-032-10486-1_33},
  langid = {en}
}

For attribution, please cite this work as:

N., Madrueño, Rueda J., García-Ochoa J., Fernández-Isabel A., Martín de Diego, I., and Romy R. Ravines. 2025. “Using LLM Agents for Data Integration in Cybersecurity Incidents.” In Intelligent Data Engineering and Automated Learning – IDEAL 2025, 16238:358–70. https://doi.org/10.1007/978-3-032-10486-1_33.