{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2025:4623BM4BEPCC34JRQPCPSLZ5QA","short_pith_number":"pith:4623BM4B","schema_version":"1.0","canonical_sha256":"e7b5b0b38123c42df13183c4f92f3d803beab469772d4b42665465ba515b344f","source":{"kind":"arxiv","id":"2506.09365","version":1},"attestation_state":"computed","paper":{"title":"ContextBuddy: AI-Enhanced Contextual Insights for Security Alert Investigation (Applied to Intrusion Detection)","license":"http://creativecommons.org/licenses/by-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Cecile Paris, Mohan Baruwal Chhetri, Ronal Singh, Surya Nepal","submitted_at":"2025-06-11T03:24:18Z","abstract_excerpt":"Modern Security Operations Centres (SOCs) integrate diverse tools, such as SIEM, IDS, and XDR systems, offering rich contextual data, including alert enrichments, flow features, and similar case histories. Yet, analysts must still manually determine which of these contextual cues are most relevant when validating specific alerts. We introduce ContextBuddy, an AI assistant that learns from analysts' prior investigations to help them identify the most relevant context for new alerts. Rather than providing enrichments, ContextBuddy models how analysts have previously selected context and suggests"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2506.09365","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-11T03:24:18Z","cross_cats_sorted":[],"title_canon_sha256":"a7642da568d390e7d918de9d5d843d03d19795b68e8fac2f5910e459bf41c94c","abstract_canon_sha256":"b7971e473bb32cc777cddd7f38f55b4cb2ece127d5852813b301ec1fb68c452f"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:19:35.731231Z","signature_b64":"mrmRtfz3Wpe3XXCMGSKu5pX9TV/70EG1c6KvOy9Qb0/ESZ7ddu4oj/FA/rlMSzpAPQQ8B+faHIGnND5jIRANCw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"e7b5b0b38123c42df13183c4f92f3d803beab469772d4b42665465ba515b344f","last_reissued_at":"2026-07-05T11:19:35.730739Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:19:35.730739Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"ContextBuddy: AI-Enhanced Contextual Insights for Security Alert Investigation (Applied to Intrusion Detection)","license":"http://creativecommons.org/licenses/by-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Cecile Paris, Mohan Baruwal Chhetri, Ronal Singh, Surya Nepal","submitted_at":"2025-06-11T03:24:18Z","abstract_excerpt":"Modern Security Operations Centres (SOCs) integrate diverse tools, such as SIEM, IDS, and XDR systems, offering rich contextual data, including alert enrichments, flow features, and similar case histories. Yet, analysts must still manually determine which of these contextual cues are most relevant when validating specific alerts. We introduce ContextBuddy, an AI assistant that learns from analysts' prior investigations to help them identify the most relevant context for new alerts. Rather than providing enrichments, ContextBuddy models how analysts have previously selected context and suggests"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.09365","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.09365/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2506.09365","created_at":"2026-07-05T11:19:35.730797+00:00"},{"alias_kind":"arxiv_version","alias_value":"2506.09365v1","created_at":"2026-07-05T11:19:35.730797+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.09365","created_at":"2026-07-05T11:19:35.730797+00:00"},{"alias_kind":"pith_short_12","alias_value":"4623BM4BEPCC","created_at":"2026-07-05T11:19:35.730797+00:00"},{"alias_kind":"pith_short_16","alias_value":"4623BM4BEPCC34JR","created_at":"2026-07-05T11:19:35.730797+00:00"},{"alias_kind":"pith_short_8","alias_value":"4623BM4B","created_at":"2026-07-05T11:19:35.730797+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":1,"internal_anchor_count":0,"sample":[{"citing_arxiv_id":"2601.03013","citing_title":"LLMs, You Can Evaluate It! Design of Multi-perspective Report Evaluation for Security Operation Centers","ref_index":67,"is_internal_anchor":false}]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/4623BM4BEPCC34JRQPCPSLZ5QA","json":"https://pith.science/pith/4623BM4BEPCC34JRQPCPSLZ5QA.json","graph_json":"https://pith.science/api/pith-number/4623BM4BEPCC34JRQPCPSLZ5QA/graph.json","events_json":"https://pith.science/api/pith-number/4623BM4BEPCC34JRQPCPSLZ5QA/events.json","paper":"https://pith.science/paper/4623BM4B"},"agent_actions":{"view_html":"https://pith.science/pith/4623BM4BEPCC34JRQPCPSLZ5QA","download_json":"https://pith.science/pith/4623BM4BEPCC34JRQPCPSLZ5QA.json","view_paper":"https://pith.science/paper/4623BM4B","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2506.09365&json=true","fetch_graph":"https://pith.science/api/pith-number/4623BM4BEPCC34JRQPCPSLZ5QA/graph.json","fetch_events":"https://pith.science/api/pith-number/4623BM4BEPCC34JRQPCPSLZ5QA/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/4623BM4BEPCC34JRQPCPSLZ5QA/action/timestamp_anchor","attest_storage":"https://pith.science/pith/4623BM4BEPCC34JRQPCPSLZ5QA/action/storage_attestation","attest_author":"https://pith.science/pith/4623BM4BEPCC34JRQPCPSLZ5QA/action/author_attestation","sign_citation":"https://pith.science/pith/4623BM4BEPCC34JRQPCPSLZ5QA/action/citation_signature","submit_replication":"https://pith.science/pith/4623BM4BEPCC34JRQPCPSLZ5QA/action/replication_record"}},"created_at":"2026-07-05T11:19:35.730797+00:00","updated_at":"2026-07-05T11:19:35.730797+00:00"}