  To address the increasing complexity and frequency of cybersecurity incidents
emphasized by the recent cybersecurity threat reports with over 10 billion
instances, cyber threat intelligence (CTI) plays a critical role in the modern
cybersecurity landscape by offering the insights required to understand and
combat the constantly evolving nature of cyber threats. Inspired by the
powerful capability of large language models (LLMs) in handling complex tasks,
in this paper, we introduce a framework to benchmark, elicit, and improve
cybersecurity incident analysis and response abilities in LLMs for Security
Events (SEvenLLM). Specifically, we create a high-quality bilingual instruction
corpus by crawling cybersecurity raw text from cybersecurity websites to
overcome the lack of effective data for information extraction. Then, we design
a pipeline to auto-select tasks from the tasks pool and convert the raw text
into supervised corpora comprised of question and response. The instruction
dataset SEvenLLM-Instruct is used to train cybersecurity LLMs with the
multi-task learning objective (27 well-designed tasks) for augmenting the
analysis of cybersecurity events. Extensive experiments in our curated
benchmark (SEvenLLM-bench) demonstrate that SEvenLLM performs more
sophisticated threat analysis and fortifies defenses against the evolving
landscape of cyber threats.
