{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:4623BM4BEPCC34JRQPCPSLZ5QA","short_pith_number":"pith:4623BM4B","canonical_record":{"source":{"id":"2506.09365","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-11T03:24:18Z","cross_cats_sorted":[],"title_canon_sha256":"a7642da568d390e7d918de9d5d843d03d19795b68e8fac2f5910e459bf41c94c","abstract_canon_sha256":"b7971e473bb32cc777cddd7f38f55b4cb2ece127d5852813b301ec1fb68c452f"},"schema_version":"1.0"},"canonical_sha256":"e7b5b0b38123c42df13183c4f92f3d803beab469772d4b42665465ba515b344f","source":{"kind":"arxiv","id":"2506.09365","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.09365","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"arxiv_version","alias_value":"2506.09365v1","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.09365","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"pith_short_12","alias_value":"4623BM4BEPCC","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"pith_short_16","alias_value":"4623BM4BEPCC34JR","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"pith_short_8","alias_value":"4623BM4B","created_at":"2026-07-05T11:19:35Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:4623BM4BEPCC34JRQPCPSLZ5QA","target":"record","payload":{"canonical_record":{"source":{"id":"2506.09365","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-11T03:24:18Z","cross_cats_sorted":[],"title_canon_sha256":"a7642da568d390e7d918de9d5d843d03d19795b68e8fac2f5910e459bf41c94c","abstract_canon_sha256":"b7971e473bb32cc777cddd7f38f55b4cb2ece127d5852813b301ec1fb68c452f"},"schema_version":"1.0"},"canonical_sha256":"e7b5b0b38123c42df13183c4f92f3d803beab469772d4b42665465ba515b344f","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:19:35.731231Z","signature_b64":"mrmRtfz3Wpe3XXCMGSKu5pX9TV/70EG1c6KvOy9Qb0/ESZ7ddu4oj/FA/rlMSzpAPQQ8B+faHIGnND5jIRANCw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"e7b5b0b38123c42df13183c4f92f3d803beab469772d4b42665465ba515b344f","last_reissued_at":"2026-07-05T11:19:35.730739Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:19:35.730739Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.09365","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:19:35Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"oVwus4mZSUv6yvsNrK3JxrbCQIx4D7SRH0mwob+bJ1j2VTskmzJxSn7hSfpFolhBV+kc6DPoez5mnvUIrKmqCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T19:37:41.141758Z"},"content_sha256":"c698f75a2d5c79b32a0a1cd14780eff6daa84fff2aa0d0560cbc3d2e075a9a92","schema_version":"1.0","event_id":"sha256:c698f75a2d5c79b32a0a1cd14780eff6daa84fff2aa0d0560cbc3d2e075a9a92"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:4623BM4BEPCC34JRQPCPSLZ5QA","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"ContextBuddy: AI-Enhanced Contextual Insights for Security Alert Investigation (Applied to Intrusion Detection)","license":"http://creativecommons.org/licenses/by-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Cecile Paris, Mohan Baruwal Chhetri, Ronal Singh, Surya Nepal","submitted_at":"2025-06-11T03:24:18Z","abstract_excerpt":"Modern Security Operations Centres (SOCs) integrate diverse tools, such as SIEM, IDS, and XDR systems, offering rich contextual data, including alert enrichments, flow features, and similar case histories. Yet, analysts must still manually determine which of these contextual cues are most relevant when validating specific alerts. We introduce ContextBuddy, an AI assistant that learns from analysts' prior investigations to help them identify the most relevant context for new alerts. Rather than providing enrichments, ContextBuddy models how analysts have previously selected context and suggests"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.09365","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.09365/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:19:35Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Pb7NGXifDqYP1IxDpDf2fkPBdcSSXrIixVXks3zWr3re9c5bGR/fM6H5mo1RvwO8RuCIaGs5kW7qWH1CRlC1Bg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T19:37:41.142306Z"},"content_sha256":"5a2c46a1573457f61839bb57f5d6dad3fd30faff1ab292639d9388223294e2c9","schema_version":"1.0","event_id":"sha256:5a2c46a1573457f61839bb57f5d6dad3fd30faff1ab292639d9388223294e2c9"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/4623BM4BEPCC34JRQPCPSLZ5QA/bundle.json","state_url":"https://pith.science/pith/4623BM4BEPCC34JRQPCPSLZ5QA/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/4623BM4BEPCC34JRQPCPSLZ5QA/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-08T19:37:41Z","links":{"resolver":"https://pith.science/pith/4623BM4BEPCC34JRQPCPSLZ5QA","bundle":"https://pith.science/pith/4623BM4BEPCC34JRQPCPSLZ5QA/bundle.json","state":"https://pith.science/pith/4623BM4BEPCC34JRQPCPSLZ5QA/state.json","well_known_bundle":"https://pith.science/.well-known/pith/4623BM4BEPCC34JRQPCPSLZ5QA/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:4623BM4BEPCC34JRQPCPSLZ5QA","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b7971e473bb32cc777cddd7f38f55b4cb2ece127d5852813b301ec1fb68c452f","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-11T03:24:18Z","title_canon_sha256":"a7642da568d390e7d918de9d5d843d03d19795b68e8fac2f5910e459bf41c94c"},"schema_version":"1.0","source":{"id":"2506.09365","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.09365","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"arxiv_version","alias_value":"2506.09365v1","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.09365","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"pith_short_12","alias_value":"4623BM4BEPCC","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"pith_short_16","alias_value":"4623BM4BEPCC34JR","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"pith_short_8","alias_value":"4623BM4B","created_at":"2026-07-05T11:19:35Z"}],"graph_snapshots":[{"event_id":"sha256:5a2c46a1573457f61839bb57f5d6dad3fd30faff1ab292639d9388223294e2c9","target":"graph","created_at":"2026-07-05T11:19:35Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.09365/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Modern Security Operations Centres (SOCs) integrate diverse tools, such as SIEM, IDS, and XDR systems, offering rich contextual data, including alert enrichments, flow features, and similar case histories. Yet, analysts must still manually determine which of these contextual cues are most relevant when validating specific alerts. We introduce ContextBuddy, an AI assistant that learns from analysts' prior investigations to help them identify the most relevant context for new alerts. Rather than providing enrichments, ContextBuddy models how analysts have previously selected context and suggests","authors_text":"Cecile Paris, Mohan Baruwal Chhetri, Ronal Singh, Surya Nepal","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-11T03:24:18Z","title":"ContextBuddy: AI-Enhanced Contextual Insights for Security Alert Investigation (Applied to Intrusion Detection)"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.09365","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:c698f75a2d5c79b32a0a1cd14780eff6daa84fff2aa0d0560cbc3d2e075a9a92","target":"record","created_at":"2026-07-05T11:19:35Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b7971e473bb32cc777cddd7f38f55b4cb2ece127d5852813b301ec1fb68c452f","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-11T03:24:18Z","title_canon_sha256":"a7642da568d390e7d918de9d5d843d03d19795b68e8fac2f5910e459bf41c94c"},"schema_version":"1.0","source":{"id":"2506.09365","kind":"arxiv","version":1}},"canonical_sha256":"e7b5b0b38123c42df13183c4f92f3d803beab469772d4b42665465ba515b344f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"e7b5b0b38123c42df13183c4f92f3d803beab469772d4b42665465ba515b344f","first_computed_at":"2026-07-05T11:19:35.730739Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:19:35.730739Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"mrmRtfz3Wpe3XXCMGSKu5pX9TV/70EG1c6KvOy9Qb0/ESZ7ddu4oj/FA/rlMSzpAPQQ8B+faHIGnND5jIRANCw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:19:35.731231Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.09365","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:c698f75a2d5c79b32a0a1cd14780eff6daa84fff2aa0d0560cbc3d2e075a9a92","sha256:5a2c46a1573457f61839bb57f5d6dad3fd30faff1ab292639d9388223294e2c9"],"state_sha256":"7c8632df13d736bc71fa423c74979b28897b16d8dde9f072edf1671654d97260"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"PxieyH5aBvBxKzBhpR8irCFMqj6iZ+Fs+kOkfDlNLfGNQM+m+PehYXfLUrAv9sEsFyGdwFLiLjb74dYUIzuYCA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-08T19:37:41.147829Z","bundle_sha256":"fdb69f3af2a02edc597f475620bd2747fcc8f869debde7747b3c3ac34ac14217"}}