Automated Generation of Cybersecurity Response Playbooks via Large Language Models
Ciprian Păduraru, Bogdan C. Dumitru, Alin Ştefănescu · Procedia Computer Science · 2025
Modern cybersecurity incident response workflows remain highly reliant on manual intervention, frequently resulting in delays and inconsistencies in threat mitigation. This paper introduces an automated method that leverages compact, fine-tuned large language models (LLMs) to generate CACAO-compliant security playbooks from structured incident data, aligned with emerging cybersecurity standards. To support both model fine-tuning and empirical evaluation, we introduce a novel dataset that integrates validated real-world incidents with systematically constructed synthetic scenarios. The approach uses a JSON-based intermediate representation to facilitate the structured transformation of incident data into executable mitigation procedures. In addition, we incorporate post-processing routines and prompt optimization techniques to improve structural validity and semantic coherence. Experimental results indicate that task-adapted compact LLMs achieve performance comparable to significantly larger models. At the same time, they reduce computational requirements, enabling deployment in resource-constrained environments and integration with existing SIEM and SOAR systems.