{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_42f43e87443ac985ef6fff5d5317a7dd5f16c91bd0e01f7e7bf3d2643e591362","bitcoin_anchor":{"bitcoin_attestations":["bitcoin_block_949451"],"calendar_attestations":["https://finney.calendar.eternitywall.com","https://btc.calendar.catallaxy.com","https://alice.btc.calendar.opentimestamps.org","https://bob.btc.calendar.opentimestamps.org"],"ots_url":"/registry/data/substrate/anchors/77fc9c28fae777b81da5b495b3115474df6592dfac590333213d3bdf8b94a9b3.ots","stamped_at":"2026-05-15T03:00:03Z","status":"bitcoin"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_42f43e87443ac985ef6fff5d5317a7dd5f16c91bd0e01f7e7bf3d2643e591362","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"85066ff8564a1b5b53dab8e5dc8a6cedff3f60b047e410dbf7145a003aa0b2b0","published":"Tue, 05 May 2026 00:00:00 -0400","receipt_hash":"85066ff8564a1b5b53dab8e5dc8a6cedff3f60b047e410dbf7145a003aa0b2b0","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"85066ff8564a1b5b53dab8e5dc8a6cedff3f60b047e410dbf7145a003aa0b2b0","observed_at":"2026-05-05T04:43:28.458286Z","parent_run_hash":"84f40dd8e6af9caa9f2a7fd632024f0e0192177c4532d9af5caf61b409324d7a","published":"Tue, 05 May 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2507.14201v3 Announce Type: replace-cross \nAbstract: We present ExCyTIn-Bench, the first benchmark to Evaluate an LLM agent X on the task of Cyber Threat Investigation through security questions derived from investigation graphs. Real-world security analysts must sift through a large number of heterogeneous security logs, follow multi-hop chains of evidence to investigate threats. With the developments of LLMs, building LLM-based agents for automatic threat investigation is a promising direction. We construct a benchmark from a controlled Azure tenant including a SQL environment covering 57 log tables from Microsoft Sentinel and related services, and 7542 generated questions. We leverage security logs extracted with expert-crafted detection logic to build threat investigation graphs, and then generate questions with LLMs using paired nodes on the graph, taking the start node as background context and the end node as answer. Anchoring each question to these explicit nodes and edge","title":"ExCyTIn-Bench: Evaluating LLM agents on Cyber Threat Investigation","url":"https://arxiv.org/abs/2507.14201","vendor":"arxiv_cs_ai"},"summary":"arXiv:2507.14201v3 Announce Type: replace-cross \nAbstract: We present ExCyTIn-Bench, the first benchmark to Evaluate an LLM agent X on the task of Cyber Threat Investigation through security questions derived from investigation graphs. Real-world security analysts must sift through a large number of heterogeneous security logs, follow multi-hop chains of evidence to investigate threats. With the developments of LLMs, building LLM-based agents for automatic threat investigation is a promising direction. We construct a benchmark from a controlled Azure tenant including a SQL environment covering 57 log tables from Microsoft Sentinel and related services, and 7542 generated questions. We leverage security logs extracted with expert-crafted detection logic to build threat investigation graphs, and then generate questions with LLMs using paired nodes on the graph, taking the start node as background context and the end node as answer. Anchoring each question to these explicit nodes and edge","title":"ExCyTIn-Bench: Evaluating LLM agents on Cyber Threat Investigation","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-05-05T04:43:28Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2507.14201"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:88ca682aac6cc3cbc313ddfd664a569ac1b0d346b26c5c0426d06e0f4f25e72bfb0c6bb6900cca34bf3df95d5e8741d405b663ef1f98fcb3e7faf62806bf3303","signer":"crovia.substrate","subject":{"observed_at":"2026-05-05T04:43:28Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2507.14201"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"e154616f044b764aa0b3d86f67f949c1e262be7b264a6dffc62a23c468cdecb2","leaf_index":114383,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"dbd0adc03791d3fd287ae91ee5740b401899828fb830303947d9936ab8ff37ce","side":"left"},{"sibling":"6a14e1e13033f29a48b1bc4ede2c1e61dbecd12e072e707b3230aaf63a50d937","side":"left"},{"sibling":"56478be9715fe2ede143a7e73d4034f916d50503739ec94a72424fd83915e713","side":"left"},{"sibling":"7434f0b922e7b53a29bef1808b208d5072297013363db3dfbc675b4424cea670","side":"left"},{"sibling":"5b0bf2723c0bb6ee05fc27836ee8d116e7df3a889e64590eaeaddc171f7c4edd","side":"right"},{"sibling":"8153de9c31dbf44f9ecde0d742b49354ad9f4fe9b906f8d8e5a0a85dc60d9b9d","side":"right"},{"sibling":"09baec6a3cd208edc886e1e59244148ab5e614e7798020eac80e734e49cc4698","side":"left"},{"sibling":"cbcf8d239488334c83b4e4700b65758e992d56d579302bc08e5c2df1fa69ea5a","side":"left"},{"sibling":"17e21f83c86c2a86dddad911d22393ee81f41d8e0b79ef8c0c48668ea846f2ca","side":"right"},{"sibling":"8df6c69f776fbba620634f6baf125eeaa6fdf9426e461e649028010d9a703f42","side":"left"},{"sibling":"ea40d1bd0432ad4dd90f023c692aaab8c8f54e27ce652e82f2ec8e16cacfb632","side":"left"},{"sibling":"673cd6d27b696232f7f65e7a0733c7df6bc9fac3bcb569907ebb0de1c72c4bb2","side":"left"},{"sibling":"76d7c4385d71ae8104107105be66eddb792e01ed6e493db5a9b4eec5441abb76","side":"left"},{"sibling":"b03f005860bf95148ea89c703a32ca19ab7a2ca71b58bb628ff94a9edb8703b0","side":"left"},{"sibling":"21d1e30b556f553dc939fddc23e6367f0a7755ebe3dd489dc0001cef017beb7f","side":"right"},{"sibling":"f2817ab288b5324fe49770372c7a10f33f7cd11005f8d4c0a730316f5229dc98","side":"left"},{"sibling":"725fac972e772ca0dc598810ea1abc70df472f72d2d6ab8a0baee2b80e5d2f4c","side":"left"},{"sibling":"98fc57dfef8873b512edc8340f7181df57302bb96777625e072235c62d7c5895","side":"right"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":134292,"merkle_root":"77fc9c28fae777b81da5b495b3115474df6592dfac590333213d3bdf8b94a9b3","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260515T023701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-05-15T02:37:25Z","sig_algorithm":"ed25519","signature":"68107a834b00b24f5d4501e5ec727445311f132a486567ecc4c72a4e6dff24c8c21f2de3105293353ba5fdbe370d032819af6aa70f694e2e39b6af6737507009","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_42f43e87443ac985ef6fff5d5317a7dd5f16c91bd0e01f7e7bf3d2643e591362"}}