Generative AI Google Brain

gemini-use-cases-graphrag-agentic-graph-rag-neo4j

4 min read

🛡️ Agentic GraphRAG: Cybersecurity Threat Intelligence

Source notebook

Repo path: gemini/use-cases/graphrag/agentic_graph_rag_neo4j.ipynb · Open on GitHub · advanced

Builds and deploys an ADK GraphRAG threat-intel agent using Neo4j and Vertex AI Agent Engine.

Summary

This notebook teaches how to seed a Neo4j cybersecurity knowledge graph with threat actors, malware, CVEs, and targets, then query it through LangChain GraphCypherQAChain. It wraps that graph query as a Google ADK tool, tests an ADK agent locally with Vertex AI reasoning_engines.AdkApp, deploys it to Vertex AI Agent Engine, queries the deployed agent, visualizes the graph with PyVis, and shows cleanup.

Key code patterns

Initialize Vertex AI and environment

os.environ["GOOGLE_CLOUD_PROJECT"] = PROJECT_ID
os.environ["GOOGLE_CLOUD_LOCATION"] = REGION
os.environ["NEO4J_URI"] = NEO4J_URI
os.environ["NEO4J_USER"] = NEO4J_USER
os.environ["NEO4J_PASSWORD"] = NEO4J_PASSWORD
 
import vertexai
vertexai.init(project=PROJECT_ID, location=REGION)

Sets project, region, and Neo4j credentials before local and remote agent work.

Seed Neo4j threat graph

graph = Neo4jGraph(url=NEO4J_URI, username=NEO4J_USER, password=NEO4J_PASSWORD)
cypher = """
MERGE (a:ThreatActor {name: 'APT29', alias: 'Cozy Bear'})
MERGE (m:Malware {name: 'WellMess'})
MERGE (v:Vulnerability {cve: 'CVE-2023-1234', severity: 'High'})
MERGE (t:Target {sector: 'Pharmaceuticals'})
MERGE (a)-[:USES]->(m)
MERGE (m)-[:EXPLOITS]->(v)
MERGE (a)-[:TARGETS]->(t)
"""
graph.query(cypher)

Creates the graph structure the agent later traverses for threat-intelligence answers.

GraphRAG tool with Cypher QA

llm = VertexAI(model_name="gemini-2.0-flash", temperature=0)
chain = GraphCypherQAChain.from_llm(
    llm=llm,
    graph=graph,
    verbose=True,
    allow_dangerous_requests=True
)
result = chain.invoke(question)
return result['result']

Uses Gemini through LangChain to translate natural-language questions into Neo4j graph queries.

ADK agent with graph tool

cyber_agent = Agent(
    name="CyberThreatIntel",
    model="gemini-2.0-flash",
    description="An expert in cybersecurity threat intelligence and graph analysis.",
    instruction="""If the user asks about Threats, Actors, or CVEs, ALWAYS use the 'query_threat_graph' tool first.""",
    tools=[query_threat_graph]
)

Registers the GraphRAG function as an ADK tool and directs the agent to consult it first.

Deploy to Agent Engine

vertexai.init(project=PROJECT_ID, location=REGION, staging_bucket=STAGING_BUCKET)
clean_app = reasoning_engines.AdkApp(agent=cyber_agent, enable_tracing=False)
wrapped_app = AgentWrapper(clean_app, project_id=PROJECT_ID, location=REGION)
remote_app = reasoning_engines.ReasoningEngine.create(
    wrapped_app,
    requirements=["google-adk>=1.0.0", "langchain-community", "neo4j"]
)

Packages the ADK app and its dependencies for managed remote execution.

Stream local or remote queries

for event in app.stream_query(user_id="analyst_01", message="Which malware does APT29 use?"):
    if 'content' in event and 'parts' in event['content']:
        part = event['content']['parts'][0]
        if 'text' in part:
            print(part['text'], end="")

Shows the streaming response pattern and the need to provide user_id for ADK session context.

Models & APIs used

  • Models: gemini-2.0-flash
  • APIs / services: Vertex AI, Vertex AI Agent Engine, Cloud Storage
  • SDKs / libraries: google-adk, google-cloud-aiplatform, langchain-google-vertexai, langchain-community, langchain, neo4j, pyvis

When to use this

Use this pattern when security analysts need an agent to answer relationship-heavy threat-intelligence questions over a Neo4j graph.

Gotchas & caveats

  • Requires a Google Cloud project with billing enabled and the Vertex AI API enabled.
  • Requires the Vertex AI User IAM role on the project.
  • Notebook skips seeding and local testing when placeholder Neo4j credentials are still present.
  • Deployment requires the configured Cloud Storage staging bucket to exist.
  • Remote execution reinitializes Vertex AI context inside AgentWrapper.stream_query.
  • The tool hard-codes Neo4j URI, user, and password inside query_threat_graph for remote execution.
  • AdkApp stream_query examples provide user_id because session context is required.
  • GraphCypherQAChain is created with allow_dangerous_requests=True.

Best practices

  • Authenticate in Colab with google.colab.auth.authenticate_user when running in Colab.
  • Use vertexai.init with explicit project and location before Vertex AI operations.
  • Re-initialize Neo4j and imports inside the tool function for serialization contexts.
  • Give the ADK agent explicit instructions to use query_threat_graph first for threats, actors, and CVEs.
  • Test the ADK app locally before deploying to Vertex AI Agent Engine.
  • Pass explicit requirements when creating the remote ReasoningEngine.
  • Delete the remote agent when finished to avoid incurring costs.
  • Visualize the graph to make graph database relationships inspectable by analysts.

Graph View

Backlinks