{"as_of":"2026-08-24T02:10:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:2177ed6aabdb4699ec836befd6df802036ae74b1a185fc0b3f6c5af686324ae7","coverage":[{"denominator":81,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":81,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T12:48:07.451736Z","state":"measured"},{"denominator":81,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":81,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-23T06:30:58.430688+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2509.01271/citation-record","integrity":"/paper/2509.01271/integrity","json":"/paper/2509.01271/citation-record.json","paper":"/paper/2509.01271"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.247889Z","title":"https://www.cisa.gov/news-events/ alerts/2020/12/13/active-exploitation- solarwinds-software","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.247889Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:882077a82ddf19ee849dac8a584e6930a955ebc390ce783765f12a421590e4d0","observation_id":"d39dfd20-1f05-4bed-b6b9-ed95906ddfba","resolution":{"observed_at":"2026-08-05T12:48:07.247889Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.131668Z","title":"https://anonymous.4open.science/r/Themis- LLM-B4EC","venue":null,"work_id":"ed0c5f3c-18bc-4a37-9dd2-6823c1b19b8f","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.251045Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:2b3a43c82f5176a9cd962f1ad9a2fd15014a22fe13fb7be8c298673ef88b301d","observation_id":"566a70af-17ad-475d-b846-4eae231ec2d6","resolution":{"observed_at":"2026-08-05T12:48:08.134545Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.122390Z","title":"https://docs.redhat.com/en/ documentation/red_hat_enterprise_linux/6/ html/security_guide/chap-system_auditing","venue":null,"work_id":"14053e11-44b1-4b35-a979-db7c841b8cdd","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.254267Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:2d0e054c3885ffbbb01f9a9991f921d7e38e4034dc2eaaf711655b14860fd11d","observation_id":"d8421e1a-7f89-4a23-8161-f9d845800ae5","resolution":{"observed_at":"2026-08-05T12:48:08.125651Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.113801Z","title":"https://www","venue":null,"work_id":"3117ab82-54bb-4e40-bd43-848717a2b278","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.257627Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:64253fa8c0b92d6b2e119608090772bdeab3de77e7f8d1961124342410c1b08b","observation_id":"f23285af-18a0-4873-9db4-14a40459aa51","resolution":{"observed_at":"2026-08-05T12:48:08.116968Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.105799Z","title":"https://csr.lanl.gov/data/","venue":null,"work_id":"a1f4b57c-bcf8-4471-8624-6cae0e0cc700","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.260461Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:ba15854f16b6dea428b3661e3a8346f6446b123a497b226a610ec9ff5ee97c2c","observation_id":"bf70b4ad-b674-469e-90d9-120c6623cb43","resolution":{"observed_at":"2026-08-05T12:48:08.108708Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.097050Z","title":"https://community.broadcom","venue":null,"work_id":"cbcfbf6f-cd36-48a3-a1db-4d7d1c9e7615","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.263494Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:4a1038c1cff87e113a005d7938f46eee8897bcee29f4d6e07e1cf7918cb156a8","observation_id":"c18ca003-851c-455c-b7b6-245d453c52ba","resolution":{"observed_at":"2026-08-05T12:48:08.099899Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.088567Z","title":"https://github.com/FiveDirections/OpTC- data","venue":null,"work_id":"5b09c882-6db6-4b9f-940b-bc30ce357e66","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.266333Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:fc1710fd74e0d7ce7e4ac5a2bf442ecad33f2d8e2107b0ddc82fafff115aaf22","observation_id":"edfefce7-bbc0-41f7-81ce-81d83f22aa59","resolution":{"observed_at":"2026-08-05T12:48:08.091575Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.079889Z","title":"https://github.com/ shramos/Awesome-Cybersecurity-Datasets","venue":null,"work_id":"b4966e2f-0e57-46b6-aef1-bfd78f03da0b","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.268832Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:d2aa08680485bfe00cec7fe4d86af6eff62a2b8ed11ecd7b63bd59f248f43d3c","observation_id":"0d42a662-790e-449a-a1f5-dde928059aef","resolution":{"observed_at":"2026-08-05T12:48:08.082915Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.071381Z","title":"https://milvus.io/zh","venue":null,"work_id":"f7b8b86f-3b1e-40d8-8e62-d4a332b89951","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.271525Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:6f44b8e5f287c133e8f5c1c50b6d8898533a93e7e9b539a4170e6f0e1ad44972","observation_id":"94eef73f-62d1-4372-b87a-818ee1af2427","resolution":{"observed_at":"2026-08-05T12:48:08.074186Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.062975Z","title":"https: //sysdig.com/","venue":null,"work_id":"4ec7094e-2f42-403f-b92e-982090a07b1c","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.273938Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:8312c642b11f1eb663eab39d80e9c0c02cd3b2478c04671bc252bf948e9242dd","observation_id":"b9a97148-4748-42b6-b026-fafd046614d9","resolution":{"observed_at":"2026-08-05T12:48:08.065735Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.053514Z","title":"https:// attack.mitre.org/campaigns/C0024/","venue":null,"work_id":"da686cc9-df6b-4ee9-9068-fe2481aa7f71","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.276398Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:5bca5e69562bb52414ae515e66a235a9cebf38335b121852e03eab5abe6b014b","observation_id":"fe329758-00c6-4915-9456-93931d68526b","resolution":{"observed_at":"2026-08-05T12:48:08.056296Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.044580Z","title":"https://cymulate.com/ cybersecurity-glossary/tactics-techniques- procedures/","venue":null,"work_id":"e725e3d2-4bdb-400e-b88a-a3e70ae1349a","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.279295Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:cd0b03a531c377d2aa9de3bd2ad3aaec086d963a89a416129a5b6dc1b3e94115","observation_id":"5d2d4935-6f49-460b-b6a7-a2143726f9b5","resolution":{"observed_at":"2026-08-05T12:48:08.047715Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.035223Z","title":"https://www.crowdstrike.com/en-us/ platform/threat-intelligence/","venue":null,"work_id":"0a038afa-76ae-4e8c-9c0d-c2cdc1524b07","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.281728Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:c099b852111be8e254c228858c3a40cbb20f49726121db671de493db25bf90b1","observation_id":"a70018ae-0d73-4506-8a3f-9eb10b361f66","resolution":{"observed_at":"2026-08-05T12:48:08.038485Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.026622Z","title":"https://en.wikipedia.org/ wiki/WannaCry_ransomware_attack","venue":null,"work_id":"e7530aeb-894f-4c83-b6d0-9acd470fd9a0","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.284177Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:f2f9d48e5b68e0b39ca2d2823dfb6894a3bf3c29386f332bc36e0020bfaba3df","observation_id":"6f80c721-3e2e-4785-89a9-218c2d7ed472","resolution":{"observed_at":"2026-08-05T12:48:08.029504Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.017934Z","title":"https://www.crowdstrike.com/en-us/ cybersecurity-101/threat-intelligence/","venue":null,"work_id":"2e76c47d-b8e8-4174-a9e0-2d2702355fe6","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.286465Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:b4a6a0cab234f0cdeba6fc9f1ab0bbcf7f8f1a46ec3a21172a9f61d2fc77bc88","observation_id":"072cbf4c-c251-4748-bfc1-24377dedc1dd","resolution":{"observed_at":"2026-08-05T12:48:08.020902Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:08.007956Z","title":"https://www.upguard.com/ blog/cyber-incident-reporting? [Accessed 11- 08-2025]","venue":null,"work_id":"dc64fe5d-963f-44b0-9f29-408eed932089","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.288761Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:a9441313c200699e114d553e4ac3c05622109b34ef3012ae5d4afcce0a5448af","observation_id":"ebaec913-5dca-4714-97d7-e05bc7799fd0","resolution":{"observed_at":"2026-08-05T12:48:08.011261Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.999105Z","title":"https://www.lockheedmartin.com/en-us/ capabilities/cyber/cyber-kill-chain.html,","venue":null,"work_id":"1257ba58-62d7-40ee-8c9a-c20552b8fbcc","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.290975Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:58d9ec513244c51488dc533298a1a8032bece11ea9b433be798d4f989697f6d2","observation_id":"a0e59622-8690-4d81-9c33-10e5c5e35844","resolution":{"observed_at":"2026-08-05T12:48:08.001914Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.981216Z","title":"Berkay Celik, Xiangyu Zhang, and Dongyan Xu","venue":null,"work_id":"dd4b0e8a-cfea-4cfd-bf31-b4984804bf07","year":2021},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.295873Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:5bfa9447a7a6468cce6cfaa36ce1e38610fcd8378e796c3cc7555e79337f1e98","observation_id":"4eef9ece-68b5-4d16-968f-c49ceb4e2fa5","resolution":{"observed_at":"2026-08-05T12:48:07.984303Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.971624Z","title":"ANY.RUN - Interactive Online Malware Sand- box — any.run","venue":null,"work_id":"37fd7496-45e8-4bb1-94c0-b15a5135a4de","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.298178Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:2770dafe612c386eaadc6ea2c408a1ed3f3852f4f3374d738e46131f057fcc22","observation_id":"15e8771b-a75f-424a-bd73-0fbf46cf3a77","resolution":{"observed_at":"2026-08-05T12:48:07.974529Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.962958Z","title":"Kairos: Practical intrusion detection and investigation using whole-system provenance","venue":null,"work_id":"ad45ac1f-6b9d-4b5c-812e-84cf2f19f88f","year":2024},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.300891Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:adf5df3e9b732579b946bf95b74d2582069c174540cc0b48524df45d6cf36e93","observation_id":"1eb6d527-c512-4407-81a2-a25eb9d8acc2","resolution":{"observed_at":"2026-08-05T12:48:07.965833Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.954179Z","title":"How to Use Threat Hunt- ing to Identify and Neutralize Advanced Per- sistent Threats — cloudoptics.ai","venue":null,"work_id":"4cba7831-be11-4971-96c3-44a2ffe680ad","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.303238Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:510226aa6f46bd59adb6a322d9c3c977e171cac77b777a2ff3c80331b5457b37","observation_id":"914fa0a4-d1e7-420e-9760-5a68487056ea","resolution":{"observed_at":"2026-08-05T12:48:07.957524Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.946051Z","title":"Cybersecurity study: SolarWinds attack cost affected companies an average of $12 million — techrepublic.com","venue":null,"work_id":"f8277ef9-6615-4949-8f23-be5450db33a7","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.305677Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:c08235f9948477ba3943fe811aaefbb788a68083b2343e0315b8ae5bd22e5de5","observation_id":"853a901b-59a3-45da-a222-b6a44c3c9274","resolution":{"observed_at":"2026-08-05T12:48:07.948944Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.937430Z","title":"AIRTAG: Towards automated attack investigation by unsupervised learning with log texts","venue":null,"work_id":"3e96fa24-ed56-43d3-872f-cc62906d1afd","year":2023},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.308074Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:9f6ced5df2848e2c1b9fbbd67d4d0e1e8fa6618d84c7d2936f0efd5d601c7af2","observation_id":"44997b87-e6ac-47db-a9e1-a1cafb6f130b","resolution":{"observed_at":"2026-08-05T12:48:07.940323Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.929187Z","title":"Event Tracing for Windows (ETW) - Windows drivers — learn.microsoft.com","venue":null,"work_id":"c952fade-9a69-4721-90ef-9d0c4191802c","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.310209Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:77b9b59defbdb49d295b1fabeec67aae5552ac553026b203e719b68961f888ba","observation_id":"e669144a-4663-4c7d-b7c1-4da23f8a3ebc","resolution":{"observed_at":"2026-08-05T12:48:07.931873Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.921623Z","title":"{DISTDET}: A {Cost-Effective} distributed cyber threat detection system","venue":null,"work_id":"e7bc55f5-5d55-4f24-92fa-89ee436bb1b3","year":2023},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.312449Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:ffc37e432d53b1634cadf316c3d0bf9511f361fe96d4b05573bc571a589a7469","observation_id":"b888b42f-b692-40e9-991b-977c1bc7f682","resolution":{"observed_at":"2026-08-05T12:48:07.924235Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.914202Z","title":"Deeplog: Anomaly detection and diagnosis from system logs through deep learning","venue":null,"work_id":"cdf79a27-a5d9-43a0-9523-5a298bb84e43","year":2017},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.314837Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:639db40623d2ada5f4dcd1038856df61167ce70843a08cebc44271cd2ef28056","observation_id":"85f6de31-c33f-4267-953a-b768ae811580","resolution":{"observed_at":"2026-08-05T12:48:07.916822Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.906668Z","title":"{Back-Propagating} system dependency impact for attack investigation","venue":null,"work_id":"f75c74ed-e7d9-46a5-9451-53803bbfae76","year":2022},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.317490Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:89dceb658fd00576459bef8b5f5eb32695b7e1fa1f30bc65fd676aed588b6839","observation_id":"6284939f-372b-443f-8bad-82d90ffd64b9","resolution":{"observed_at":"2026-08-05T12:48:07.909254Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2501.12948","last_updated":"2026-01-04T03:57:36Z","snapshot_observed_at":"2026-08-15T12:33:55.451951Z","submitted_at":"2025-01-22T15:19:35Z","title":"DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.12948","snapshot_observed_at":"2026-08-05T12:48:07.319845Z","title":"Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.319845Z"},"links":{"cited_paper":"/paper/2501.12948","citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:02699e76294695afb7f981bc3894eec75236a76e1b888f3f5275b0fce59a6b72","observation_id":"83b1ab74-8b76-4e2a-8aac-c9e5caacb720","resolution":{"observed_at":"2026-08-05T12:48:07.319845Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2001.01525","last_updated":"2020-01-14T12:26:28Z","snapshot_observed_at":"2026-08-18T10:50:33.697563Z","submitted_at":"2020-01-06T12:42:51Z","title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2001.01525","snapshot_observed_at":"2026-08-05T12:48:07.322575Z","title":"Unicorn: Runtime provenance-based detector for advanced persistent threats","venue":null,"work_id":null,"year":2001},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.322575Z"},"links":{"cited_paper":"/paper/2001.01525","citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:1f988711c9053101f66acd4bbcb859a396087fe10358e9dbb30aad01abeed2e7","observation_id":"8601ab0e-4514-46d9-a344-f5b8501e39d3","resolution":{"observed_at":"2026-08-05T12:48:07.322575Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.898964Z","title":"Tac- tical provenance analysis for endpoint detection and response systems","venue":null,"work_id":"2c7c5e41-479a-4445-9cd0-dbf7db188b66","year":2020},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.325276Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:bc9cd7b071c9755a6b5b6d49c1283fa1deb623242b4ec50f2c5b8010e3484f01","observation_id":"940a3319-46d5-411d-bf7e-9671b536ff43","resolution":{"observed_at":"2026-08-05T12:48:07.901784Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.891310Z","title":"Nodoze: Combatting threat alert fatigue with automated provenance triage","venue":null,"work_id":"4f082aeb-4fda-4794-8b9d-8500eee58201","year":2019},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.327622Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:2fdfde3fac805ef722baca509a9fa332f8162c6d5eae48299720af7344abb2d1","observation_id":"4908d3b7-cb86-4426-8ebf-ef6b36f57a51","resolution":{"observed_at":"2026-08-05T12:48:07.894153Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.883846Z","title":"In 26th USENIX Security Symposium (USENIX Security 17), pages 487–504, 2017","venue":null,"work_id":"7f298629-9113-4e9a-b64d-95c3833ec47c","year":2017},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.329826Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:37eff05e4ca241ec2284e58f4f189480c522800281be587c285ea092aba12ceb","observation_id":"44551808-0009-4be7-b618-0e73245d5afa","resolution":{"observed_at":"2026-08-05T12:48:07.886602Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.875249Z","title":"Sellafield apologises after guilty plea over string of cybersecurity failings — theguardian.com","venue":null,"work_id":"9197c84b-2b6f-4718-b03c-657e911fd9d0","year":2024},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.332169Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:72b52bba6217f844c99946c9334d331abfbc36816410bcf001ed956d67942deb","observation_id":"6ba5029e-8021-460b-be67-307e28a55722","resolution":{"observed_at":"2026-08-05T12:48:07.878339Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.866945Z","title":"Rain: Refinable attack investigation with on- demand inter-process information flow tracking","venue":null,"work_id":"c36656df-e5e3-4c70-9890-f7ac6c1b829f","year":2017},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.334415Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:3cb18151194a214304e3ac55b1c55154032c6eec581e87131b8adaf05f6cd697","observation_id":"185d40a6-1f97-484b-b50b-02851f933121","resolution":{"observed_at":"2026-08-05T12:48:07.869694Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.859292Z","title":"{MAGIC}: Detecting advanced per- sistent threats via masked graph representation learning","venue":null,"work_id":"3ed9c515-8e7f-4ec7-9957-45324e9a2fdd","year":2024},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.336881Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:14d0f6f1295eb0bd965ef5cadc6277d9c5b47620d38160c76713948bb8275524","observation_id":"74593940-df9f-43cd-9eae-983c0c2d7f32","resolution":{"observed_at":"2026-08-05T12:48:07.861894Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.851386Z","title":"Orthrus: Achieving high quality of attribution in provenance-based intrusion de- tection systems","venue":null,"work_id":"a7f3d9a9-9f68-4fd4-92ee-d0b0c5d5527e","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.339198Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:0087f1c8d91cc30cc8abce487c43f5191f94abcdf579ac8c22ca4da1f6a3e382","observation_id":"8fcf7285-79b2-4a5b-abb9-302727fc05e0","resolution":{"observed_at":"2026-08-05T12:48:07.854057Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.843265Z","title":"Temporal decay loss for adaptive log anomaly detection in cloud environments","venue":null,"work_id":"129f2e4a-98f4-4a0d-aff9-59f9ecdb8dcf","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.341508Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:0bcf496701b9bec9e4cb6d7d753c673748095fc9578416a27a56caa89c203bc1","observation_id":"ebd3f98c-83c6-4785-9541-a5f32aea58fd","resolution":{"observed_at":"2026-08-05T12:48:07.846345Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.835484Z","title":"Prov-gem: Au- tomated provenance analysis framework using graph embeddings","venue":null,"work_id":"f2519ef1-59c6-4577-99a4-279e90f3a37e","year":2021},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.343899Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:0b579e285f117a54e7fd16ad20e8e75a547dfec1653968377d1a7350df559d30","observation_id":"11aad21a-b419-478e-83a6-c1cdc6d25f66","resolution":{"observed_at":"2026-08-05T12:48:07.838344Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.346137Z","title":"Measuring catastrophic forgetting in neural networks","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.346137Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:f426048d56ff633c27aec6221fae88a5c6f65f92167e1a540ead150bea84e180","observation_id":"377460e7-a61c-4408-b004-d4459d32ff21","resolution":{"observed_at":"2026-08-05T12:48:07.346137Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.823227Z","title":"High accuracy attack provenance via binary-based exe- cution partition","venue":null,"work_id":"03da3903-59fe-4617-b474-0641e2fb7569","year":2013},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.348923Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:19e06e590b0e93871e960ae7a4430b91489bc02a7a121ca614838278bdf9a976","observation_id":"3405be81-eaa8-4802-9e60-acd6eb5420a9","resolution":{"observed_at":"2026-08-05T12:48:07.825920Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.815643Z","title":"LevelBlue Labs Open Threat Exchange — levelblue.com","venue":null,"work_id":"902a9c0f-a907-4ca6-8650-ba275f2df33b","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.351277Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:10608ec811ed629de6ad5593761b2c38aaee2f407d2ec0ad176929171332466b","observation_id":"67e3009d-f64a-4089-acc9-a9c8c13c4491","resolution":{"observed_at":"2026-08-05T12:48:07.818146Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.353626Z","title":"Retrieval-augmented generation for knowledge- intensive nlp tasks","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.353626Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:b9dd70c51ec768912f94a91241757488e57d7a9cf40727ed3a5f4f462010a6b5","observation_id":"6efee85d-0cbf-4456-858e-eeb02c1ccf10","resolution":{"observed_at":"2026-08-05T12:48:07.353626Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.802557Z","title":"A hierarchical approach for advanced persis- tent threat detection with attention-based graph neu- ral networks","venue":null,"work_id":"81bcf11e-e288-48ef-96e1-68e3f746f2c4","year":2021},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.355982Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:0a1b72b30392f90c1f914d4b2e69c8e81cff71648985605f162a48379b9c678e","observation_id":"231becc9-b191-4442-9b27-a5d36a799e1e","resolution":{"observed_at":"2026-08-05T12:48:07.805522Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.794647Z","title":"Log2vec: A heteroge- neous graph embedding based approach for detecting cyber threats within enterprise","venue":null,"work_id":"5a0f5d37-c91a-4f72-8952-22a3cc84295e","year":2019},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.358233Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:267af666cfc0f8d2e21758d2f7aace118eb48a9c9b935e0a3e80ed87b5d48ec2","observation_id":"e442ad01-c6b9-41d4-a5e7-17b44508d8d2","resolution":{"observed_at":"2026-08-05T12:48:07.797692Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.787126Z","title":"APT28 Cyber Espionage Campaign Targets Logistics and Tech Compa- nies, CISA Warns — reveal.security","venue":null,"work_id":"bacb3f6d-6bd7-4e54-aae7-a989d3ce1aec","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.360560Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:c2acd2d386a6a52b6d091804c4eb2312eab8c897d7df33bb028a0bfebde96a8d","observation_id":"8d871bd8-247a-4a75-a61c-82bfcb225c13","resolution":{"observed_at":"2026-08-05T12:48:07.789833Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.779132Z","title":"Pro- tracer: Towards practical provenance tracing by alter- nating between logging and tainting","venue":null,"work_id":"4fc5e8d6-eeac-4cd2-b6bc-2ac18b245a90","year":2016},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.362841Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:b42641a49b86d09aa2e4d139e47f6ffb541fc1dbf0a2eb55e8bd2b3a50f8a1bb","observation_id":"6f42ffc6-917e-4372-b41c-8ea60ce04eca","resolution":{"observed_at":"2026-08-05T12:48:07.781920Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.771943Z","title":"Sysmon - Sysinternals — learn.microsoft.com","venue":null,"work_id":"4c319d3c-c2d2-4fc7-936e-5069778286fe","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.365066Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:551d8898c683599a9694e76d2abe25ff5a17b1a34fe4c185d21f28994a8e2def","observation_id":"fd4527df-aad0-4547-931e-e308a6dea680","resolution":{"observed_at":"2026-08-05T12:48:07.774436Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.763705Z","title":"Poirot: Aligning attack be- havior with kernel audit records for cyber threat hunting","venue":null,"work_id":"9e145957-61e7-4217-881c-98e683e8e8b8","year":2019},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.369806Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:69952e3aa0661c7c607b1243b324ec1afc3d1c3468c05cbc1c2d187b8c847bf6","observation_id":"279c288e-d136-426a-92d6-a7de29592c4d","resolution":{"observed_at":"2026-08-05T12:48:07.766547Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.756034Z","title":"Holmes: real-time apt detection through correlation of suspicious information flows","venue":null,"work_id":"94ee4f6f-c509-4ae1-87ca-15a56549f4b0","year":2019},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.372347Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:14fc8f4bbfb9a6691fb53d95e2224f362746321e5d0fd210e16a5ac3564bfde4","observation_id":"0dd9298b-2955-4b4b-a81d-909b38f66427","resolution":{"observed_at":"2026-08-05T12:48:07.758683Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.748239Z","title":"Mitre att&ck, 2020","venue":null,"work_id":"e6b9b306-cb93-4aa9-86f9-da7868003107","year":2020},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.375043Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:73e86bea303ec5d41f475f28489804127642570f0884a1d7dabb4329e1de2b93","observation_id":"a8f0fffc-094d-429e-acb0-f37e8e9f6b73","resolution":{"observed_at":"2026-08-05T12:48:07.751027Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.740237Z","title":"Custos: Practical tamper-evident auditing of operating systems using trusted execution","venue":null,"work_id":"3a0d608b-cdf6-4ddf-b3d7-99b4547600e9","year":2020},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.377676Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:58aae64c6cd17061a84f4a68c7c2c90eb6a64e02c72b7a23100b2adea1c47eda","observation_id":"3712e7f3-bb65-4faa-8da5-82be9d03861f","resolution":{"observed_at":"2026-08-05T12:48:07.743217Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.731806Z","title":"Logging to the danger zone: Race condition attacks and defenses on system audit frameworks","venue":null,"work_id":"55fa2655-fdf9-4525-b53f-32aec40aa9ad","year":2020},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.380549Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:3ee7fac8505922dcd6d84e15b5788c0994301ba0a9bd016a864370b4d66344f0","observation_id":"4934948f-1f05-48e7-84d7-f63155e134ef","resolution":{"observed_at":"2026-08-05T12:48:07.734923Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.723044Z","title":"Hercule: Attack story re- construction via community discovery on correlated log graph","venue":null,"work_id":"e25337ed-1d31-479f-963a-23b467ff5a87","year":2016},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.382917Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:98484d879af6a218704d399178242493a6f105e96e0fa7f5b8bf3a8e7818d74b","observation_id":"a85c0ba7-2f2d-4d29-a7d8-9979881c246e","resolution":{"observed_at":"2026-08-05T12:48:07.725726Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.715197Z","title":"No-doubt: Attack attribution based on threat intelligence reports","venue":null,"work_id":"6f13d96b-54f7-4fcf-8293-866b905d9912","year":2019},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.385642Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:fc1924ba620f0337eff913606796fdb96910113f2849f0012fd24b6f3544c6ee","observation_id":"64bd88ab-a129-431c-96a9-a27234b10e16","resolution":{"observed_at":"2026-08-05T12:48:07.718021Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.707109Z","title":"{ATTACK2VEC}: Leveraging temporal word embeddings to understand the evolution of cyberattacks","venue":null,"work_id":"1264f75a-b08f-492b-b8c4-58f15839cbff","year":2019},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.388152Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:6becfb8d022a806c4aaad663c6bd7099930235e315010fcec63d4dfa699d90fe","observation_id":"7feceb49-1ae2-4f45-9cfb-6c507b9ec103","resolution":{"observed_at":"2026-08-05T12:48:07.709927Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.697942Z","title":"APT and financial attacks on industrial organizations in Q4 2024 | Kaspersky ICS CERT — ics-cert.kaspersky.com","venue":null,"work_id":"09061298-24f3-423d-9496-e8ff847fd38f","year":2024},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.390414Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:7cf879bf6f718e3d7879d1f4055e5a6e93b9e8d9968d15b94a3f72c70fc37d80","observation_id":"2d2eb9ac-2c2b-49a1-8b52-dba7c3edfb38","resolution":{"observed_at":"2026-08-05T12:48:07.701410Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.07521","last_updated":"2023-12-16T12:47:19Z","snapshot_observed_at":"2026-08-18T10:45:30.869066Z","submitted_at":"2023-10-11T14:18:03Z","title":"Survey on Factuality in Large Language Models: Knowledge, Retrieval and Domain-Specificity","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.07521","snapshot_observed_at":"2026-08-05T12:48:07.392732Z","title":"Sur- vey on factuality in large language models: Knowl- edge, retrieval and domain-specificity","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.392732Z"},"links":{"cited_paper":"/paper/2310.07521","citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:f438a8e2f1b468e321008f3bd05cb6ac899f773fc0eaa1b030dd5bb99473803a","observation_id":"879316ac-d833-4932-813e-e9aef8cc8ab3","resolution":{"observed_at":"2026-08-05T12:48:07.392732Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.689026Z","title":"Threatrace: Detecting and tracing host-based threats in node level through provenance graph learn- ing","venue":null,"work_id":"bce43d79-9c29-4636-9452-4755e02b97fa","year":2022},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.395655Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:76a9c7fd3610244999fc692b737581d620753380fa0562b6d910a7c89a04384d","observation_id":"0c5dfbd1-1f29-4326-8193-5c1fbf893a64","resolution":{"observed_at":"2026-08-05T12:48:07.692043Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.398055Z","title":"Chain-of-thought prompting elicits reasoning in large language models","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.398055Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:cd4d5a468c54edc1c410f7d811ae9ba3d8b190761b77d8a058ca013672eaa023","observation_id":"dfb394dc-7140-4c49-a405-dc11cf2d0382","resolution":{"observed_at":"2026-08-05T12:48:07.398055Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.674718Z","title":"On the ef- fectiveness of log representation for log-based anomaly detection","venue":null,"work_id":"2336c4ed-5f54-4053-ad28-90fc871f9141","year":2023},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.400495Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:a41e3d363c4920dae7585bd4d632e2ad8296550ff37c380a7aec9314cc9acf4c","observation_id":"0080c2c1-7b22-48a5-a399-f2fca9acf62c","resolution":{"observed_at":"2026-08-05T12:48:07.677733Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.666271Z","title":"Depcomm: Graph sum- marization on system audit logs for attack investigation","venue":null,"work_id":"2a924c57-98b4-4369-b82f-df154f6b957c","year":2022},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.402836Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:1a5458d5d8b053042239d80fa5b2b73545988e5aa55e92dd5098cb67a9b823c0","observation_id":"c410fdea-c40f-46c4-88e3-0cc947031a2c","resolution":{"observed_at":"2026-08-05T12:48:07.669098Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.657851Z","title":"{PROGRAPHER}: An anomaly detection system based on provenance graph embedding","venue":null,"work_id":"cc7140b8-781f-4adf-bcdb-8374e78209be","year":2023},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.405213Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:4263145fe86a21caa18f48293cee23ed0d36622769d589068a8b2552b5eb1470","observation_id":"e04404d3-a97b-4662-9d97-8b4366b5a1f2","resolution":{"observed_at":"2026-08-05T12:48:07.661294Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.650094Z","title":"Shadewatcher: Recommendation-guided cyber threat analysis using system audit records","venue":null,"work_id":"31c3ac69-a478-4672-bf48-147a9b68466e","year":2022},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.407700Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:051a3d79ecb98553d56b6d216b62f0412edd27797b176a533486c6b709210129","observation_id":"c4e561c6-1196-4bbe-a167-33a5cdf3f7a6","resolution":{"observed_at":"2026-08-05T12:48:07.653064Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2303.18223","last_updated":"2026-03-18T05:34:39Z","snapshot_observed_at":"2026-08-14T10:40:26.323157Z","submitted_at":"2023-03-31T17:28:46Z","title":"A Survey of Large Language Models","version":19},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.18223","snapshot_observed_at":"2026-08-05T12:48:07.410186Z","title":"A survey of large lan- guage models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.410186Z"},"links":{"cited_paper":"/paper/2303.18223","citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:93df1af3f4ea8e10745ad89ddca48dec974af4e5b762b2f155f81e4c4f67db4b","observation_id":"9e7944e7-65e5-4d65-894f-07d4d016cb6c","resolution":{"observed_at":"2026-08-05T12:48:07.410186Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.642060Z","title":"Attack pattern discovery in forensic inves- tigation of network attacks","venue":null,"work_id":"5fbc32e8-ce49-42b8-bdd7-36f1d879da1f","year":2011},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.412846Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:855cce98230181a2fddb17edf675b0cdc8fbbaaa0d59dd5cf8a10fcfba40d942","observation_id":"c20d7be6-0d52-471e-aa1e-004deba1e0cd","resolution":{"observed_at":"2026-08-05T12:48:07.645136Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.634609Z","title":null,"venue":null,"work_id":"6d5cf59e-65c5-436d-ad5f-f577f871642d","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.415250Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:3bcd1d13c0c69b798a44aaf1439ef3a1c7fb08f82e5a4994a836c2637e6c5f53","observation_id":"d2be9051-687b-4a51-8837-61c68c681660","resolution":{"observed_at":"2026-08-05T12:48:07.637039Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.626000Z","title":null,"venue":null,"work_id":"01611a88-e831-46b5-b6b9-ee00309b3fd1","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.417726Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:6748e4ba6b8d65183343513087c7ea32c63df9f853764b773b5ea2a81408c800","observation_id":"fd4b94c7-3eda-44ca-8503-e69145080066","resolution":{"observed_at":"2026-08-05T12:48:07.628742Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.616958Z","title":null,"venue":null,"work_id":"86c424f3-2f32-47ff-aa10-c993cfdf43a8","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.420363Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:02ab99b7a030f82ae4d5598ab2a0ece20e7a4897cf0ed44d923ed705b02df12b","observation_id":"eb2c672f-5494-4979-b07a-16728645668b","resolution":{"observed_at":"2026-08-05T12:48:07.620451Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.607822Z","title":null,"venue":null,"work_id":"d2b0c90c-bb1d-43df-a18f-4382117822ea","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.422877Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:41266c54e57e3c1bc0513aaeceec025a9cca8284de103f25edda48d0627e5a34","observation_id":"1edb5423-01da-425b-8c05-757af8f3d33c","resolution":{"observed_at":"2026-08-05T12:48:07.611827Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.599150Z","title":"Strictly preserve the original temporal order","venue":null,"work_id":"32e4c4ee-8444-4649-9225-3a84967eff33","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.425477Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:b8668e2f90c20c3877d9e30467ddd464c48ecd879c2034a1d439000fc2f05db2","observation_id":"0c48c3c6-1469-4c7c-a5e5-3d747905e3ba","resolution":{"observed_at":"2026-08-05T12:48:07.602086Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.591139Z","title":null,"venue":null,"work_id":"ddb02d7a-3040-453e-ab92-854537b1d694","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.428708Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:626885562945af4951091db46d85333f5768fe4eeef364f4894ecbc3c9724130","observation_id":"8e3a427b-ba20-4319-9e69-ab4a29588e46","resolution":{"observed_at":"2026-08-05T12:48:07.593664Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.582617Z","title":null,"venue":null,"work_id":"49765f63-59dd-4ae9-a496-873876bcfaa2","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.431482Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:ca95f936c14ce82b47f5f1a42454f7ebc51f598b91594150023aa4e56e8b9e22","observation_id":"43ca30f1-6b56-4452-a1d8-b0ca31476ac2","resolution":{"observed_at":"2026-08-05T12:48:07.585798Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.572750Z","title":"18 5.evidence_set must fully retain the original log en- tries","venue":null,"work_id":"fadbb93e-46fa-4fbf-bfc0-a68a20f34797","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.433911Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:17545ed246d50e2be17b73f7bde446d52ee2095be973363df1065ed2517a2ed4","observation_id":"57acd3f4-166c-426a-9a2e-9bf0dba643fc","resolution":{"observed_at":"2026-08-05T12:48:07.575947Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.564330Z","title":null,"venue":null,"work_id":"995fdcb4-a9b9-48f4-9643-3f022425f0cf","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.436675Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:bff784b10ca8c440cb9ca726ad9c8ede9ee853fbe7f4830d65d32f03f5ec9146","observation_id":"961782f0-c9fe-47f2-9550-2925ea34090a","resolution":{"observed_at":"2026-08-05T12:48:07.567072Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.554363Z","title":"A.2 Prompt for Causal Reasoning Prompt for Causal Reasoning You are a cyber forensic analyst investigating poten- tial attacks in preprocessed system logs","venue":null,"work_id":"385999fc-0f8e-4ad2-b718-465a1392c5f5","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.439212Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:f11f4afa6b163f9db3cf407d1f3c4eb7a8f405acaed5e7439870376fb527a497","observation_id":"91595eaa-7e8e-4224-9e43-d953224e29a9","resolution":{"observed_at":"2026-08-05T12:48:07.557883Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.545442Z","title":null,"venue":null,"work_id":"0c9fc8e3-8a4f-48c8-ae47-cd2e8752e140","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.441644Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:f7d5dcd54cf7fa8505eeda2f7fc430b6af300c218003d9eab512b4882f647959","observation_id":"6c32db01-e95f-4a92-8421-9ce618ab31da","resolution":{"observed_at":"2026-08-05T12:48:07.548215Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.536423Z","title":"3.Infer causality between the current and previous window based on behavioral continuity","venue":null,"work_id":"63e83502-dbc0-4e6d-8782-2ca11b7398a9","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.444055Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:cd7cf0724ffef73b94fd8b333924fdfc623782cdc5dfcb09a992854ec9703cf9","observation_id":"4a0c8a3e-4017-407e-814e-62db82fe7849","resolution":{"observed_at":"2026-08-05T12:48:07.539658Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.527414Z","title":"3.Summarize abnormal behaviors and their causal relationships, highlighting how each suspicious entity contributed to the attack progression","venue":null,"work_id":"4e416ba3-606d-42ff-97cc-24739bc6ccf4","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":80,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.446662Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:af40c68a49dc063f4da023ae0f7c6a6eeabe9f1dae7dcea8952a1d7340d95f6a","observation_id":"64164020-2bc0-41ed-beb8-3e8639827c05","resolution":{"observed_at":"2026-08-05T12:48:07.530539Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.518628Z","title":null,"venue":null,"work_id":"40a44f0d-d10d-4dd1-ac9f-79782ab23442","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":81,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.449218Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:82db4f5924c46c2e85ebffe5cc47a7c7cfe84fb9c736ad0b02d1737583e25070","observation_id":"beefd86a-2d65-4180-9f36-58f7dba7708f","resolution":{"observed_at":"2026-08-05T12:48:07.521374Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.507717Z","title":"The final report should provide clear forensic evidence for each phase and conclude with a concise explanation of the overall attack chain and its implications for defense","venue":null,"work_id":"8fcc7def-bea0-41d6-b8fe-af54c86abd3b","year":null},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":82,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.451736Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:f140c02d23b69fcc1ed7afd436a13c1fdadbecb24c98b952227e7f69a394e9a9","observation_id":"6129fb3d-b32a-42b0-a477-8648a89fab98","resolution":{"observed_at":"2026-08-05T12:48:07.512742Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T12:48:07.990188Z","title":null,"venue":null,"work_id":"ba33a129-ca0f-4492-932a-30dc4671eac4","year":2025},"citing_paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models","version":1},"reference_index":2025,"source":"pdf_text","source_observed_at":"2026-08-05T12:48:07.293447Z"},"links":{"citing_paper":"/paper/2509.01271"},"observation_digest":"sha256:833674d4204cc5af999303afcc6088374a69d7be8e4b68cea7efbc7eff73c728","observation_id":"647f18cd-4095-4cdc-b84d-0f7fc248a68c","resolution":{"observed_at":"2026-08-05T12:48:07.993286Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2509.01271","last_updated":"2025-09-01T08:57:01Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-19T17:44:07.001471Z","submitted_at":"2025-09-01T08:57:01Z","title":"An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models"},"reference_resolution":{"displayed":81,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":18,"verified_exact":0,"verified_fuzzy":63},"total_outbound_references":81},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"thesis":"As of 24 August 2026, this Paper Citation Record lists 81 of 81 outbound references and 0 inbound Pith citation observations for arXiv:2509.01271."}