This paper presents CyberRAG, a novel framework for effectively processing the massive volume of alerts generated by enterprise IDS/IPS systems. CyberRAG is an agent-based Retrieval-Augmented Generation (RAG) framework designed around fine-tuned classifiers for each attack type, tool adapters for alert and information enrichment, and an iterative retrieval and inference loop that queries a domain-specific knowledge base. Unlike existing RAGs, CyberRAG adopts an agent-based design that enables dynamic control flow and adaptive inference. It autonomously refines threat labels and natural language descriptions, thereby reducing false positives and enhancing interpretability. Evaluation results for SQL Injection, XSS, and SSTI demonstrated over 94% accuracy for each class and a final classification accuracy of 94.92%. The generated descriptions achieved a BERTScore of 0.94 and a GPT-4-based expert evaluation score of 4.9/5. CyberRAG demonstrates scalability, supporting new attack types by adding classifiers without retraining the core agent.
