{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:BMPDGQJAYVKV6LVF2ETPXLVGJ7","short_pith_number":"pith:BMPDGQJA","canonical_record":{"source":{"id":"2509.23571","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-28T02:08:17Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"0c700a11e7398b91b35e1718d3a0d6514ed7559f9d9d4e3a4cfcf847038b7ed2","abstract_canon_sha256":"c6c9df51156499e837cb154973da0899abf6d7d8afe4fe46dd6a9b87c36255f0"},"schema_version":"1.0"},"canonical_sha256":"0b1e334120c5555f2ea5d126fbaea64fdf38e01178746e0edd56c30c4a4249cc","source":{"kind":"arxiv","id":"2509.23571","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2509.23571","created_at":"2026-05-29T01:04:56Z"},{"alias_kind":"arxiv_version","alias_value":"2509.23571v3","created_at":"2026-05-29T01:04:56Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.23571","created_at":"2026-05-29T01:04:56Z"},{"alias_kind":"pith_short_12","alias_value":"BMPDGQJAYVKV","created_at":"2026-05-29T01:04:56Z"},{"alias_kind":"pith_short_16","alias_value":"BMPDGQJAYVKV6LVF","created_at":"2026-05-29T01:04:56Z"},{"alias_kind":"pith_short_8","alias_value":"BMPDGQJA","created_at":"2026-05-29T01:04:56Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:BMPDGQJAYVKV6LVF2ETPXLVGJ7","target":"record","payload":{"canonical_record":{"source":{"id":"2509.23571","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-28T02:08:17Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"0c700a11e7398b91b35e1718d3a0d6514ed7559f9d9d4e3a4cfcf847038b7ed2","abstract_canon_sha256":"c6c9df51156499e837cb154973da0899abf6d7d8afe4fe46dd6a9b87c36255f0"},"schema_version":"1.0"},"canonical_sha256":"0b1e334120c5555f2ea5d126fbaea64fdf38e01178746e0edd56c30c4a4249cc","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-29T01:04:56.094186Z","signature_b64":"KwskAkf+cfGhPPt9I9xL5M30nUKNqy6TkxOJoRuDmXbo/p8zkn+hq4UwTbLyUMq9hnMn2NR25DQRHB0E/KzPAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"0b1e334120c5555f2ea5d126fbaea64fdf38e01178746e0edd56c30c4a4249cc","last_reissued_at":"2026-05-29T01:04:56.093721Z","signature_status":"signed_v1","first_computed_at":"2026-05-29T01:04:56.093721Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2509.23571","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-29T01:04:56Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"NnjpdERsi7q3oWGFxhU4LsKNNAyDZ4gP/s3JDmaJSzMbMU77+bM67KDBxAyy2OdrGpx+OWVudu4azSaLFGPKBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-11T13:55:58.576409Z"},"content_sha256":"4bbc654303885accbb1cb28add3f86b9cb72a397140249721811f74911fb7faf","schema_version":"1.0","event_id":"sha256:4bbc654303885accbb1cb28add3f86b9cb72a397140249721811f74911fb7faf"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:BMPDGQJAYVKV6LVF2ETPXLVGJ7","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Benchmarking LLM-Assisted Blue Teaming via Standardized Threat Hunting","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Feiyang Yu, Guanhua Yan, Luoxi Tang, Ping Yang, Xi Li, Yuqiao Meng, Zhaohan Xi","submitted_at":"2025-09-28T02:08:17Z","abstract_excerpt":"As cyber threats continue to grow in scale and sophistication, blue team defenders increasingly require advanced tools to proactively detect and mitigate risks. Large Language Models (LLMs) offer promising capabilities for enhancing threat analysis. However, their effectiveness in real-world blue team threat-hunting scenarios remains insufficiently explored. This paper presents CyberTeam, a benchmark designed to guide LLMs in blue teaming practice. CyberTeam constructs a standardized workflow in two stages. First, it models realistic threat-hunting workflows by capturing the dependencies among"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.23571","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2509.23571/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-29T01:04:56Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"RAuUtSCl4ASMrJ/u/UlFDQlzAnpcEPpOyRBbyL8IFEq0nwqLzpWr1XAjcr8QYofAPsElRLUDHw4ILg7j15jUAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-11T13:55:58.577076Z"},"content_sha256":"6df1472830afae626c5171d1e5076d4ddc10f440a5d7c0288deb4603c5e6610f","schema_version":"1.0","event_id":"sha256:6df1472830afae626c5171d1e5076d4ddc10f440a5d7c0288deb4603c5e6610f"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/BMPDGQJAYVKV6LVF2ETPXLVGJ7/bundle.json","state_url":"https://pith.science/pith/BMPDGQJAYVKV6LVF2ETPXLVGJ7/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/BMPDGQJAYVKV6LVF2ETPXLVGJ7/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-11T13:55:58Z","links":{"resolver":"https://pith.science/pith/BMPDGQJAYVKV6LVF2ETPXLVGJ7","bundle":"https://pith.science/pith/BMPDGQJAYVKV6LVF2ETPXLVGJ7/bundle.json","state":"https://pith.science/pith/BMPDGQJAYVKV6LVF2ETPXLVGJ7/state.json","well_known_bundle":"https://pith.science/.well-known/pith/BMPDGQJAYVKV6LVF2ETPXLVGJ7/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:BMPDGQJAYVKV6LVF2ETPXLVGJ7","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"c6c9df51156499e837cb154973da0899abf6d7d8afe4fe46dd6a9b87c36255f0","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-28T02:08:17Z","title_canon_sha256":"0c700a11e7398b91b35e1718d3a0d6514ed7559f9d9d4e3a4cfcf847038b7ed2"},"schema_version":"1.0","source":{"id":"2509.23571","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2509.23571","created_at":"2026-05-29T01:04:56Z"},{"alias_kind":"arxiv_version","alias_value":"2509.23571v3","created_at":"2026-05-29T01:04:56Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.23571","created_at":"2026-05-29T01:04:56Z"},{"alias_kind":"pith_short_12","alias_value":"BMPDGQJAYVKV","created_at":"2026-05-29T01:04:56Z"},{"alias_kind":"pith_short_16","alias_value":"BMPDGQJAYVKV6LVF","created_at":"2026-05-29T01:04:56Z"},{"alias_kind":"pith_short_8","alias_value":"BMPDGQJA","created_at":"2026-05-29T01:04:56Z"}],"graph_snapshots":[{"event_id":"sha256:6df1472830afae626c5171d1e5076d4ddc10f440a5d7c0288deb4603c5e6610f","target":"graph","created_at":"2026-05-29T01:04:56Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2509.23571/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"As cyber threats continue to grow in scale and sophistication, blue team defenders increasingly require advanced tools to proactively detect and mitigate risks. Large Language Models (LLMs) offer promising capabilities for enhancing threat analysis. However, their effectiveness in real-world blue team threat-hunting scenarios remains insufficiently explored. This paper presents CyberTeam, a benchmark designed to guide LLMs in blue teaming practice. CyberTeam constructs a standardized workflow in two stages. First, it models realistic threat-hunting workflows by capturing the dependencies among","authors_text":"Feiyang Yu, Guanhua Yan, Luoxi Tang, Ping Yang, Xi Li, Yuqiao Meng, Zhaohan Xi","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-28T02:08:17Z","title":"Benchmarking LLM-Assisted Blue Teaming via Standardized Threat Hunting"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.23571","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4bbc654303885accbb1cb28add3f86b9cb72a397140249721811f74911fb7faf","target":"record","created_at":"2026-05-29T01:04:56Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"c6c9df51156499e837cb154973da0899abf6d7d8afe4fe46dd6a9b87c36255f0","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-28T02:08:17Z","title_canon_sha256":"0c700a11e7398b91b35e1718d3a0d6514ed7559f9d9d4e3a4cfcf847038b7ed2"},"schema_version":"1.0","source":{"id":"2509.23571","kind":"arxiv","version":3}},"canonical_sha256":"0b1e334120c5555f2ea5d126fbaea64fdf38e01178746e0edd56c30c4a4249cc","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"0b1e334120c5555f2ea5d126fbaea64fdf38e01178746e0edd56c30c4a4249cc","first_computed_at":"2026-05-29T01:04:56.093721Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-29T01:04:56.093721Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"KwskAkf+cfGhPPt9I9xL5M30nUKNqy6TkxOJoRuDmXbo/p8zkn+hq4UwTbLyUMq9hnMn2NR25DQRHB0E/KzPAw==","signature_status":"signed_v1","signed_at":"2026-05-29T01:04:56.094186Z","signed_message":"canonical_sha256_bytes"},"source_id":"2509.23571","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4bbc654303885accbb1cb28add3f86b9cb72a397140249721811f74911fb7faf","sha256:6df1472830afae626c5171d1e5076d4ddc10f440a5d7c0288deb4603c5e6610f"],"state_sha256":"60b024abfca13e1a985d13dfc8a262ad57a40cd3b39e0d67c86719e38e13fcbe"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Kq1VSCS9MsZKSPIApOkKXXH3FReYLhvC6+Kd02vsi7pmso7paMIlbxHzI5IkSk7HuIak0lNF33lIhGwNLaI+DQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-11T13:55:58.583215Z","bundle_sha256":"9c94742ee3db077283a45586ebaa158f571489ffc1b2b31ce3546a6a64581e34"}}