A county SOC builds a vector index of past IR tickets so analysts can enrich new incidents with similar historical context. Which technique does that describe?

A county SOC that builds a vector index of past IR tickets so analysts can enrich new incidents with similar historical context is implementing retrieval-augmented enrichment over an embedding index of civic IR history. Embeddings place tickets in a semantic space so “similar” means conceptual closeness—same malware family patterns, same business unit pain, same containment mistakes—not only exact keyword overlap. Retrieved neighbors then supply local context the model or analyst can use without reinventing prior lessons.

The correct technique works because it keeps enrichment tied to the municipality’s own incident history inside a searchable index. Analysts gain speed and continuity while remaining able to open the underlying tickets and verify what actually happened.

Instruction-tuning an LLM on synthetic civic IR tickets for policy-aligned generation of response playbooks fails the stated goal: it teaches the model to generate playbooks from synthetic examples rather than retrieving real similar cases from a vector index of actual history, so it does not provide the retrievable, verifiable historical context the design requires.

Fine-tuning an LLM on labeled civic IR tickets for automated triage prediction from parametric memory fails the stated goal: it compresses ticket history into model weights for prediction rather than retrieving specific similar cases from an index, so it does not provide the retrievable, verifiable historical context the design requires.

Indexing civic IR tickets with BM25 keyword search for lexical lookup of similar incident identifiers fails operationally: BM25 matching only finds exact identifier or term overlap, not the conceptual similarity across incidents that a vector embedding index provides.

Exam caveat: Vector index + similar historical context ≈ RAG-style retrieval enrichment. Do not confuse that with instruction-tuning for policy-aligned playbook generation, fine-tuning for parametric prediction, or relying on BM25 keyword lookup.

Operational check: Verify the embedding index covers approved ticket fields, that PII minimization is applied before indexing, and that analysts can click through from retrieved neighbors to the authoritative ticket records.