Evidence-First Retrieval Augmented Generation with Claim Repair for Security Operations Center Workflows

Retrieval Augmented Generation (RAG) is increasingly used in Security Operations Center (SOC) workflows, yet standard pipelines may still produce confident claims that are weakly grounded in retrieved evidence. We present Evidence-First RAG (EFIR), a trustworthiness pipeline for security analysis, Common Vulnerabilities and Exposures (CVE) impact assessment, and containment planning. EFIR integrates retrieval steering, schema-constrained structured generation with span-level citations, claim level verification, evidence relinking, and repair. EFIR is evaluated on SOC oriented CVE benchmarks that cover both naturalistic open retrieval and component level ablation settings. The evaluation uses reliability, retrieval coverage, and verified actionability metrics, together with a separate human annotation study for verifier reliability. In these settings, EFIR improves the quality of evidence based output by reducing verifier negative content and increasing verified actionability, while the ablation results show that retrieval steering and repair provide complementary gains. A separate annotation study on 300 claims further supports the verification component, yielding a checker accuracy of 0.91 and inter-rater $\kappa=0.692$.