{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:4623BM4BEPCC34JRQPCPSLZ5QA","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b7971e473bb32cc777cddd7f38f55b4cb2ece127d5852813b301ec1fb68c452f","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-11T03:24:18Z","title_canon_sha256":"a7642da568d390e7d918de9d5d843d03d19795b68e8fac2f5910e459bf41c94c"},"schema_version":"1.0","source":{"id":"2506.09365","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.09365","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"arxiv_version","alias_value":"2506.09365v1","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.09365","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"pith_short_12","alias_value":"4623BM4BEPCC","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"pith_short_16","alias_value":"4623BM4BEPCC34JR","created_at":"2026-07-05T11:19:35Z"},{"alias_kind":"pith_short_8","alias_value":"4623BM4B","created_at":"2026-07-05T11:19:35Z"}],"graph_snapshots":[{"event_id":"sha256:5a2c46a1573457f61839bb57f5d6dad3fd30faff1ab292639d9388223294e2c9","target":"graph","created_at":"2026-07-05T11:19:35Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.09365/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Modern Security Operations Centres (SOCs) integrate diverse tools, such as SIEM, IDS, and XDR systems, offering rich contextual data, including alert enrichments, flow features, and similar case histories. Yet, analysts must still manually determine which of these contextual cues are most relevant when validating specific alerts. We introduce ContextBuddy, an AI assistant that learns from analysts' prior investigations to help them identify the most relevant context for new alerts. Rather than providing enrichments, ContextBuddy models how analysts have previously selected context and suggests","authors_text":"Cecile Paris, Mohan Baruwal Chhetri, Ronal Singh, Surya Nepal","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-11T03:24:18Z","title":"ContextBuddy: AI-Enhanced Contextual Insights for Security Alert Investigation (Applied to Intrusion Detection)"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.09365","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:c698f75a2d5c79b32a0a1cd14780eff6daa84fff2aa0d0560cbc3d2e075a9a92","target":"record","created_at":"2026-07-05T11:19:35Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b7971e473bb32cc777cddd7f38f55b4cb2ece127d5852813b301ec1fb68c452f","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-11T03:24:18Z","title_canon_sha256":"a7642da568d390e7d918de9d5d843d03d19795b68e8fac2f5910e459bf41c94c"},"schema_version":"1.0","source":{"id":"2506.09365","kind":"arxiv","version":1}},"canonical_sha256":"e7b5b0b38123c42df13183c4f92f3d803beab469772d4b42665465ba515b344f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"e7b5b0b38123c42df13183c4f92f3d803beab469772d4b42665465ba515b344f","first_computed_at":"2026-07-05T11:19:35.730739Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:19:35.730739Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"mrmRtfz3Wpe3XXCMGSKu5pX9TV/70EG1c6KvOy9Qb0/ESZ7ddu4oj/FA/rlMSzpAPQQ8B+faHIGnND5jIRANCw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:19:35.731231Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.09365","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:c698f75a2d5c79b32a0a1cd14780eff6daa84fff2aa0d0560cbc3d2e075a9a92","sha256:5a2c46a1573457f61839bb57f5d6dad3fd30faff1ab292639d9388223294e2c9"],"state_sha256":"7c8632df13d736bc71fa423c74979b28897b16d8dde9f072edf1671654d97260"}