KNOWLEDGE GRAPH WITH RAG
Plain Notes
1. What is a Knowledge Graph?
A Knowledge Graph is a way of organizing information by representing real-world things and
the relationships between them.
Instead of storing information only as documents, rows, or text chunks, a Knowledge Graph
represents information as:
Entities + Relationships + Properties
For example:
Customer
↓ purchased
Product
↓ manufactured by
Company
↓ located in
Country
Another example from an IT environment:
Payment Application
↓ runs on
Server-01
↓ connects to
Payment Database
↓ hosted on
Database Server-02
The Knowledge Graph understands not only the individual objects but also how those objects
are connected.
2. Basic Components of a Knowledge Graph
A Knowledge Graph mainly contains three components:
Entity / Node
Represents an object or concept.
Examples:
• Customer
• Product
• Application
• Server
• Database
• Employee
• Department
• Incident
• Document
Relationship / Edge
Represents how two entities are connected.
Examples:
• Customer PURCHASED Product
• Employee WORKS_FOR Department
• Application RUNS_ON Server
• Application CONNECTS_TO Database
• Incident AFFECTED Application
Properties
Provide additional information about an entity or relationship.
Example:
Server:
Name = Server-01
Environment = Production
Region = East
Status = Active
Therefore:
Node = What it is
Relationship = How it is connected
Property = Additional information about it
3. Simple Knowledge Graph Example
Consider an enterprise application.
Payment Application
↓ RUNS_ON
Server-01
Payment Application
↓ CONNECTS_TO
Payment Database
Payment Application
↓ USES
Certificate-ABC
Incident-1001
↓ AFFECTED
Payment Application
Incident-1001
↓ CAUSED_BY
Certificate-ABC
Runbook-25
↓ RESOLVES
Certificate Failure
Now the system has connected knowledge.
If someone asks:
“Which incidents affected the payment application because of certificate problems?”
the Knowledge Graph can traverse:
Payment Application
← AFFECTED BY
Incident
↓ CAUSED BY
Certificate
This is very different from simply searching documents containing the word certificate.
4. What is RAG?
RAG means:
Retrieval-Augmented Generation
RAG retrieves relevant enterprise information before asking the Large Language Model to
generate an answer.
Basic RAG flow:
User Question
↓
Search Enterprise Knowledge
↓
Retrieve Relevant Information
↓
Provide Information to LLM
↓
LLM Generates Answer
For example:
User asks:
“Why did the payment application fail yesterday?”
The RAG system retrieves:
• Application logs
• Incident reports
• Troubleshooting documents
• Runbooks
The retrieved information is given to the LLM.
The LLM then generates an answer based on enterprise information.
5. Traditional Vector RAG
A common RAG implementation uses a Vector Database.
Documents
↓
Extract Text
↓
Chunk Documents
↓
Generate Embeddings
↓
Vector Database
When the user asks a question:
User Question
↓
Generate Query Embedding
↓
Vector Similarity Search
↓
Retrieve Similar Chunks
↓
LLM
↓
Answer
This is very effective for finding information based on semantic similarity.
For example:
Question:
“Why is the application unable to communicate with the database?”
The Vector Database may retrieve:
“Database connectivity failures can occur when the connection pool is exhausted.”
The words are different, but the meaning is similar.
6. Limitation of Vector-Only RAG
Vector RAG is excellent at finding similar content, but it may have difficulty answering
questions involving multiple relationships.
Consider:
Customer A
↓ owns
Policy B
↓ associated with
Claim C
↓ investigated by
Employee D
Now the user asks:
“Who investigated the claim associated with Customer A's policy?”
This requires following relationships:
Customer A
→ Policy B
→ Claim C
→ Employee D
A Vector Database may retrieve relevant text chunks, but it does not naturally represent this
relationship chain.
A Knowledge Graph is better suited for such queries.
This leads to:
Knowledge Graph + RAG
often referred to as:
Graph RAG
7. What is Graph RAG?
Graph RAG combines:
Knowledge Graph
Information Retrieval
Large Language Model
The Knowledge Graph provides:
• Entities
• Relationships
• Dependencies
• Connected context
The LLM provides:
• Natural-language understanding
• Reasoning
• Explanation
• Response generation
The combined flow is:
User Question
↓
Understand Question
↓
Identify Entities
↓
Search Knowledge Graph
↓
Traverse Relationships
↓
Retrieve Connected Context
↓
Provide Context to LLM
↓
Generate Answer
8. Example of Graph RAG
Consider an IT environment.
Knowledge Graph:
Payment Service
↓ RUNS_ON
Server-A
Server-A
↓ LOCATED_IN
Production Cluster
Payment Service
↓ CONNECTS_TO
Payment Database
Payment Service
↓ USES
TLS Certificate-101
Incident-500
↓ AFFECTED
Payment Service
Incident-500
↓ CAUSED_BY
TLS Certificate-101
Runbook-20
↓ RESOLVES
Certificate Failure
Now the user asks:
“Why did the Payment Service fail and how was it resolved previously?”
The Graph RAG system can traverse:
Payment Service
↓
Incident-500
↓
TLS Certificate-101
↓
Certificate Failure
↓
Runbook-20
The LLM receives this connected information.
It can then explain:
“The Payment Service previously failed because of a TLS certificate issue. Incident-500 was
associated with Certificate-101. Runbook-20 contains the approved remediation procedure.”
The answer is based on connected enterprise knowledge, not just similar paragraphs.
9. Vector RAG vs Graph RAG
Vector RAG answers:
“What content is similar to this question?”
Graph RAG answers:
“What entities are related to this question, and how are they connected?”
For example:
Vector RAG
Question:
“How do I fix a certificate error?”
Searches for:
Documents semantically similar to certificate troubleshooting.
Graph RAG
Question:
“Which production applications use the certificate that expired yesterday?”
Traverses:
Certificate
↓ USED_BY
Application
↓ DEPLOYED_IN
Production
Graph RAG is therefore particularly useful for relationship-heavy questions.
10. Knowledge Graph Creation
Enterprise information usually starts in multiple systems.
Examples:
• Databases
• Data Lake
• PDFs
• Word documents
• APIs
• Application logs
• Incident systems
• CMDB
• Source-code repositories
• Business applications
The first step is to identify entities and relationships.
Example document:
“Payment Service runs on Server-01 and connects to PaymentDB.”
Entity extraction identifies:
Payment Service
Server-01
PaymentDB
Relationship extraction identifies:
Payment Service
RUNS_ON
Server-01
Payment Service
CONNECTS_TO
PaymentDB
These are stored in the Knowledge Graph.
11. Knowledge Graph Construction Pipeline
A typical pipeline is:
Enterprise Data Sources
↓
Data Extraction
↓
Content Processing
↓
Entity Extraction
↓
Relationship Extraction
↓
Entity Resolution
↓
Knowledge Graph Creation
Entity resolution is particularly important.
For example:
Payment Service
Payment-Service
PAYMENT_SERVICE
Payment API Service
may sometimes refer to the same business entity.
The system must determine whether they should become one canonical entity.
12. Knowledge Graph Schema
Before building a large enterprise Knowledge Graph, it is useful to define the types of entities
and relationships.
For an IT operations Knowledge Graph:
Entity Types
Application
Service
Server
Database
API
Certificate
Incident
Error
Runbook
Team
Employee
Environment
Relationships
Application RUNS_ON Server
Application CONNECTS_TO Database
Application CALLS API
Application USES Certificate
Incident AFFECTS Application
Incident CAUSED_BY Error
Runbook RESOLVES Error
Team OWNS Application
Employee MEMBER_OF Team
Application DEPLOYED_IN Environment
This provides a consistent enterprise knowledge model.
13. Knowledge Graph with Vector Database
Knowledge Graph and Vector Database do not have to compete.
A strong enterprise RAG architecture can use both.
The Vector Database answers:
“What information is semantically similar?”
The Knowledge Graph answers:
“What information is connected?”
Therefore:
Vector Search + Graph Search + LLM
can provide better retrieval.
Architecture:
Enterprise Data Sources
↓
Data Lake
↓
Content Processing
↓
Entity / Relationship Extraction
↓
Knowledge Graph
At the same time:
Content Processing
↓
Chunking
↓
Embedding Generation
↓
Vector Database
Then:
User Question
↓
Query Understanding
↓
Vector Search + Graph Search
↓
Combined Context
↓
LLM
↓
Grounded Answer
14. Example of Hybrid Graph + Vector RAG
User asks:
“Why is checkout failing after yesterday's certificate update?”
Step 1 – Vector Search
Search documents similar to:
• Checkout failure
• Certificate update
• TLS problem
It retrieves:
• Incident description
• Troubleshooting guide
• Historical resolution
Step 2 – Knowledge Graph Search
Identify:
Checkout Service
Then traverse:
Checkout Service
↓ USES
Certificate-789
Certificate-789
↓ UPDATED_ON
Yesterday
Checkout Service
↓ CONNECTS_TO
Payment API
Incident-300
↓ AFFECTS
Checkout Service
Step 3 – Combine Context
The system combines:
Semantic evidence from Vector DB
Relationship evidence from Knowledge Graph
Step 4 – LLM
The LLM receives the combined information and generates a grounded answer.
This is much stronger than depending only on vector similarity.
15. Graph RAG for Enterprise Knowledge
Consider an organization containing:
Employees
Departments
Projects
Customers
Products
Documents
Policies
Applications
Servers
Databases
Incidents
All these entities have relationships.
For example:
Employee
↓ WORKS_FOR
Department
Employee
↓ WORKS_ON
Project
Project
↓ DELIVERED_FOR
Customer
Project
↓ USES
Technology
Document
↓ BELONGS_TO
Project
Now someone asks:
“Which employees worked on projects for Customer ABC that used Databricks?”
The graph can traverse:
Customer ABC
← DELIVERED_FOR
Project
↓ USES
Databricks
Project
← WORKS_ON
Employee
The result can then be explained naturally by the LLM.
16. Graph RAG for IT Operations
Graph RAG is particularly useful for operational troubleshooting.
Consider:
Application
↓ RUNS_ON
Server
Application
↓ CONNECTS_TO
Database
Application
↓ DEPENDS_ON
API
Application
↓ OWNED_BY
Team
Incident
↓ AFFECTS
Application
Error
↓ CAUSED
Incident
Runbook
↓ RESOLVES
Error
Now a production error occurs.
Error
↓
Identify Application
↓
Find Dependencies
↓
Find Related Incidents
↓
Find Historical Root Causes
↓
Find Runbooks
↓
Generate Recommended Resolution
This makes the Knowledge Graph useful for root-cause analysis and self-healing systems.
17. Graph RAG for Impact Analysis
Another important use case is impact analysis.
Suppose:
Database-01 will be upgraded.
The system can ask:
“What applications could be affected if Database-01 is unavailable?”
Knowledge Graph:
Database-01
↑ CONNECTS_TO
Payment Application
Database-01
↑ CONNECTS_TO
Order Application
Database-01
↑ CONNECTS_TO
Reporting Service
Therefore the system can identify potentially affected applications.
It can continue traversing:
Application
↓ OWNED_BY
Team
and identify which teams should be informed.
This type of dependency analysis is difficult to perform reliably using only vector similarity.
18. Graph RAG for Customer 360
Knowledge Graphs are also useful for customer intelligence.
Customer
↓ OWNS
Account
Customer
↓ PURCHASED
Product
Customer
↓ CREATED
Support Ticket
Customer
↓ SUBMITTED
Claim
Customer
↓ INTERACTED_WITH
Campaign
Now the user can ask:
“Show the products, open support issues and recent interactions for Customer A.”
Graph RAG can collect connected information and allow the LLM to create a readable summary.
19. Security in Knowledge Graph RAG
Enterprise Knowledge Graphs may contain sensitive information.
Security should therefore be enforced during retrieval.
User
↓
Authentication
↓
Authorization
↓
Graph Access Rules
↓
Vector Access Rules
↓
Retrieve Authorized Context
↓
LLM
Security may be applied at:
• Entity level
• Relationship level
• Document level
• Business-domain level
• Row level
• User/role level
The LLM should receive only information that the user is authorized to access.
20. Data Lake + Vector DB + Knowledge
Graph + RAG
A complete enterprise AI knowledge architecture can be represented as:
DATA LAKE
Stores original enterprise information.
VECTOR DATABASE
Stores semantic representations of content.
KNOWLEDGE GRAPH
Stores entities and relationships.
RAG RETRIEVAL
Retrieves relevant semantic and connected information.
LLM
Understands and generates answers.
AI APPLICATIONS
Enterprise Search
Knowledge Assistant
Customer 360
Developer Assistant
IT Support
Root-Cause Analysis
Impact Analysis
Self-Healing Operations
AI Agents
21. Role of Each Technology
Component Main Purpose
Data Lake Store original enterprise data
Vector Database Find information based on semantic similarity
Knowledge Graph Understand entities and relationships
Metadata Provide business and security context
RAG Retrieve enterprise knowledge before generation
LLM Understand questions and generate answers
AI Agent Use knowledge to perform multi-step tasks
22. Vector RAG vs Graph RAG vs Hybrid
RAG
Vector RAG
Best when the question is:
“What documents or passages are similar to my question?”
Example:
“How do I resolve a database timeout?”
Graph RAG
Best when the question is:
“How are these things connected?”
Example:
“Which applications depend on Database-01?”
Hybrid Graph + Vector RAG
Best when the question needs both meaning and relationships.
Example:
“Why did the payment application fail after the certificate update, what dependent services were
affected, and how was the same problem resolved previously?”
Here:
Vector Search
finds historical incidents, documentation and runbooks.
Knowledge Graph
finds applications, certificates, servers, dependencies and affected services.
LLM
combines everything into an understandable response.
23. Complete Graph RAG Architecture
Enterprise Data Sources
Databases | Data Lake | PDFs | Documents | APIs | Logs | CMDB | Incidents
INGESTION & PROCESSING
Extract | Parse | Clean | Classify
Two parallel knowledge paths can be created.
Semantic Knowledge Path
Documents
↓
Chunking
↓
Embedding Model
↓
Vector Database
Relationship Knowledge Path
Documents / Structured Data
↓
Entity Extraction
↓
Relationship Extraction
↓
Entity Resolution
↓
Knowledge Graph
Then:
User Question
↓
Query Understanding
↓
Entity Identification
↓
Vector Search + Graph Traversal
↓
Metadata & Security Filtering
↓
Context Assembly
↓
LLM
↓
Grounded Answer + Source References
24. Simple Way to Remember
Think about the three layers this way:
Data Lake
“What information do I have?”
Vector Database
“What information has a similar meaning?”
Knowledge Graph
“How is the information connected?”
RAG
“What information should I retrieve for this question?”
LLM
“How do I understand and explain the retrieved information?”
Therefore, the complete enterprise AI knowledge architecture becomes:
Data Lake = Storage
Vector DB = Semantic Understanding
Knowledge Graph = Relationship Understanding
RAG = Retrieval
LLM = Reasoning and Response
25. Final Summary
A Knowledge Graph should not necessarily replace a Vector Database.
They solve different problems.
Vector Database
is strong at:
• Semantic search
• Similarity search
• Document retrieval
• Finding related passages
Knowledge Graph
is strong at:
• Entity relationships
• Dependency analysis
• Multi-hop queries
• Impact analysis
• Connected enterprise knowledge
Using them together creates a stronger RAG architecture:
Enterprise Data
↓
Vector Knowledge + Graph Knowledge
↓
Hybrid Retrieval
↓
LLM
↓
Grounded Enterprise AI
The key idea is:
Vector RAG finds similar knowledge. Graph RAG finds connected knowledge. Hybrid
Graph + Vector RAG provides both semantic and relationship-aware enterprise
intelligence.