RIG-RAG: A GraphRAG Inspired Approach to Agentic Cloud Infrastructure

Benji Lilley, Brian Mitchell, Spiros Mancoridis
Proceedings of the 2025 Conference on Applied Machine Learning for Information Security, PMLR 299:292-311, 2025.

Abstract

Modern cloud environments contain thousands of interdependent resources that frequently change, making them complex to monitor with traditional tools. This paper introduces Relational Inference GraphRAG (RIG-RAG), a pair of LLM-assisted inference pipelines that transform raw cloud configuration data into a security-enriched typed knowledge graph to support natural-language reasoning about deployed infrastructure. RIG-RAG enables organizations to execute natural language security queries against their cloud environments and to support the continuous validation of critical questions such as "What resources are publicly accessible?" or "Which identities can read from databases?". Our implementation, SkyShark IQ, processes queries in two modes: interactive mode for ad hoc user interaction, and oversight mode for periodically executed curated inquiries that monitor infrastructure drift. By extracting cloud resource configurations into a typed graph structure with inferred security relationships, SkyShark IQ allows security teams to reason over complex infrastructure through an intuitive conversational interface. Based on the current state of the deployed infrastructure, the system provides role-appropriate security insights, providing technical details to analysts, explaining implementation impacts to product owners, and presenting contextual risk summaries to business leaders. We deployed and evaluated our system in a production AWS environment that supports 300,000 users, demonstrating its ability to simplify complex infrastructure analysis, surface hidden security relationships, and provide verifiable, role-appropriate explanations that improve situational awareness and cross-team communication in operational security workflows.

Cite this Paper

BibTeX
@InProceedings{pmlr-v299-lilley25a, title = {RIG-RAG: A GraphRAG Inspired Approach to Agentic Cloud Infrastructure}, author = {Lilley, Benji and Mitchell, Brian and Mancoridis, Spiros}, booktitle = {Proceedings of the 2025 Conference on Applied Machine Learning for Information Security}, pages = {292--311}, year = {2025}, editor = {Raff, Edward and Rudd, Ethan M.}, volume = {299}, series = {Proceedings of Machine Learning Research}, month = {22--24 Oct}, publisher = {PMLR}, pdf = {https://raw.githubusercontent.com/mlresearch/v299/main/assets/lilley25a/lilley25a.pdf}, url = {https://proceedings.mlr.press/v299/lilley25a.html}, abstract = {Modern cloud environments contain thousands of interdependent resources that frequently change, making them complex to monitor with traditional tools. This paper introduces Relational Inference GraphRAG (RIG-RAG), a pair of LLM-assisted inference pipelines that transform raw cloud configuration data into a security-enriched typed knowledge graph to support natural-language reasoning about deployed infrastructure. RIG-RAG enables organizations to execute natural language security queries against their cloud environments and to support the continuous validation of critical questions such as "What resources are publicly accessible?" or "Which identities can read from databases?". Our implementation, SkyShark IQ, processes queries in two modes: interactive mode for ad hoc user interaction, and oversight mode for periodically executed curated inquiries that monitor infrastructure drift. By extracting cloud resource configurations into a typed graph structure with inferred security relationships, SkyShark IQ allows security teams to reason over complex infrastructure through an intuitive conversational interface. Based on the current state of the deployed infrastructure, the system provides role-appropriate security insights, providing technical details to analysts, explaining implementation impacts to product owners, and presenting contextual risk summaries to business leaders. We deployed and evaluated our system in a production AWS environment that supports 300,000 users, demonstrating its ability to simplify complex infrastructure analysis, surface hidden security relationships, and provide verifiable, role-appropriate explanations that improve situational awareness and cross-team communication in operational security workflows.} }
Endnote
%0 Conference Paper %T RIG-RAG: A GraphRAG Inspired Approach to Agentic Cloud Infrastructure %A Benji Lilley %A Brian Mitchell %A Spiros Mancoridis %B Proceedings of the 2025 Conference on Applied Machine Learning for Information Security %C Proceedings of Machine Learning Research %D 2025 %E Edward Raff %E Ethan M. Rudd %F pmlr-v299-lilley25a %I PMLR %P 292--311 %U https://proceedings.mlr.press/v299/lilley25a.html %V 299 %X Modern cloud environments contain thousands of interdependent resources that frequently change, making them complex to monitor with traditional tools. This paper introduces Relational Inference GraphRAG (RIG-RAG), a pair of LLM-assisted inference pipelines that transform raw cloud configuration data into a security-enriched typed knowledge graph to support natural-language reasoning about deployed infrastructure. RIG-RAG enables organizations to execute natural language security queries against their cloud environments and to support the continuous validation of critical questions such as "What resources are publicly accessible?" or "Which identities can read from databases?". Our implementation, SkyShark IQ, processes queries in two modes: interactive mode for ad hoc user interaction, and oversight mode for periodically executed curated inquiries that monitor infrastructure drift. By extracting cloud resource configurations into a typed graph structure with inferred security relationships, SkyShark IQ allows security teams to reason over complex infrastructure through an intuitive conversational interface. Based on the current state of the deployed infrastructure, the system provides role-appropriate security insights, providing technical details to analysts, explaining implementation impacts to product owners, and presenting contextual risk summaries to business leaders. We deployed and evaluated our system in a production AWS environment that supports 300,000 users, demonstrating its ability to simplify complex infrastructure analysis, surface hidden security relationships, and provide verifiable, role-appropriate explanations that improve situational awareness and cross-team communication in operational security workflows.
APA
Lilley, B., Mitchell, B. & Mancoridis, S.. (2025). RIG-RAG: A GraphRAG Inspired Approach to Agentic Cloud Infrastructure. Proceedings of the 2025 Conference on Applied Machine Learning for Information Security, in Proceedings of Machine Learning Research 299:292-311 Available from https://proceedings.mlr.press/v299/lilley25a.html.

Related Material