{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_55474a24710a5775bfe1ccec20d5923e5d3b8fed790dce683dcf14d269fe86a5","bitcoin_anchor":{"bitcoin_attestations":["bitcoin_block_949451"],"calendar_attestations":["https://finney.calendar.eternitywall.com","https://btc.calendar.catallaxy.com","https://alice.btc.calendar.opentimestamps.org","https://bob.btc.calendar.opentimestamps.org"],"ots_url":"/registry/data/substrate/anchors/77fc9c28fae777b81da5b495b3115474df6592dfac590333213d3bdf8b94a9b3.ots","stamped_at":"2026-05-15T03:00:03Z","status":"bitcoin"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_55474a24710a5775bfe1ccec20d5923e5d3b8fed790dce683dcf14d269fe86a5","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"30367420d35fdf9f55dc54bded474dadd0ee3aea3602676352e924fe5949ece4","published":"Wed, 06 May 2026 00:00:00 -0400","receipt_hash":"30367420d35fdf9f55dc54bded474dadd0ee3aea3602676352e924fe5949ece4","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"30367420d35fdf9f55dc54bded474dadd0ee3aea3602676352e924fe5949ece4","observed_at":"2026-05-06T04:43:18.518819Z","parent_run_hash":"184209fc0f2ebdc4b721e1a74f74ab17637dab3344682b6e6bd1f3e5e8f2cd00","published":"Wed, 06 May 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2603.18196v3 Announce Type: replace-cross \nAbstract: Investigating cybersecurity incidents requires collecting and analyzing evidence from multiple log sources, including intrusion detection alerts, network traffic records, and authentication events. This process is labor-intensive: analysts must sift through large volumes of data to identify relevant indicators and piece together what happened. We present a RAG-based system that performs security incident analysis through targeted query-based filtering and LLM semantic reasoning. The system uses a query library with associated MITRE ATT&CK techniques to extract indicators from raw logs, then retrieves relevant context to answer forensic questions and reconstruct attack sequences. We evaluate the system with eight LLM configurations on malware traffic incidents and a multi-stage Active Directory attack. We find that LLMs have different performance and tradeoffs, with Claude Sonnet 4 achieving 94% and DeepSeek V3 achieving 89% ave","title":"Retrieval-Augmented LLMs for Security Incident Analysis","url":"https://arxiv.org/abs/2603.18196","vendor":"arxiv_cs_ai"},"summary":"arXiv:2603.18196v3 Announce Type: replace-cross \nAbstract: Investigating cybersecurity incidents requires collecting and analyzing evidence from multiple log sources, including intrusion detection alerts, network traffic records, and authentication events. This process is labor-intensive: analysts must sift through large volumes of data to identify relevant indicators and piece together what happened. We present a RAG-based system that performs security incident analysis through targeted query-based filtering and LLM semantic reasoning. The system uses a query library with associated MITRE ATT&CK techniques to extract indicators from raw logs, then retrieves relevant context to answer forensic questions and reconstruct attack sequences. We evaluate the system with eight LLM configurations on malware traffic incidents and a multi-stage Active Directory attack. We find that LLMs have different performance and tradeoffs, with Claude Sonnet 4 achieving 94% and DeepSeek V3 achieving 89% ave","title":"Retrieval-Augmented LLMs for Security Incident Analysis","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-05-06T04:43:18Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2603.18196"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:6460e4b2661343583e5e0bf60edcb039d885ba511273847bf3b33aed670bc8a3fd7fd6ab028fb9160e65e9cccc5d12b44d577274ce0328edebdceb097c8f820e","signer":"crovia.substrate","subject":{"observed_at":"2026-05-06T04:43:18Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2603.18196"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"a47aabaa1fefa73b0a0e9a5de04ebc1e6cf0b7786a7e1bf50e8a41de54a2ca65","leaf_index":116567,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"ee8a77c708f53a6044206eec3c494fbc40cf5512fabb244e0643e42fd84c9709","side":"left"},{"sibling":"6f1cf2f17a629a06f82fce91b00edacb9cbd1572df58857db1c127ef98f601e2","side":"left"},{"sibling":"30b8e6ba36fc3b7162c0b49c58f4f25d139ebdc9c1243d8c384d39cb530b1bb6","side":"left"},{"sibling":"b648a2492c3db58d7f4ac1d70fe45c6532518bb0036a24f91bfc08b96c21138d","side":"right"},{"sibling":"5813628980c3cdf595a087c098ed35296f3b49a0a51ffad79db6e43e111052d4","side":"left"},{"sibling":"0a3211eda132db5ecca736cf354c9a1804233dd952ec60cc6ff2c390cc104015","side":"right"},{"sibling":"dd4277f33b532244672f719abb849e200a307f7c7efa590e2eb41dbbb1e7844f","side":"left"},{"sibling":"6ee45885d9cd9ed12596a458214030b8197200a928104b38bdab7a9d649f44f8","side":"right"},{"sibling":"5574ba66329e909ad4ff093e3491b05d5aa4f4ee91405ec5ecdb639bea7d87ab","side":"left"},{"sibling":"c750384c973eaf46aa237cdabe7a75729862dd4101dca10cb8e0626e0ec2d34a","side":"left"},{"sibling":"ddc060ac400459417799f688c75d5b271636afa40d89ec7fc98652473a8061f6","side":"left"},{"sibling":"282afa51266e47629e34d808a360bbb276348bcc5a24bdcc93e83a76e580293e","side":"right"},{"sibling":"05f89b32c00462e60adf95c1fe4579cdc2791b36e8b17573d8f3b5fd5da95a0b","side":"right"},{"sibling":"8ccd9937a2c0d5c04044d07d1557791b7d07bb31eac41a39a675608d44b38f23","side":"right"},{"sibling":"3a5e69cf0803f4c91f3895ed7c9a95748fef240bec4422e167c05300f79f06c0","side":"left"},{"sibling":"f2817ab288b5324fe49770372c7a10f33f7cd11005f8d4c0a730316f5229dc98","side":"left"},{"sibling":"725fac972e772ca0dc598810ea1abc70df472f72d2d6ab8a0baee2b80e5d2f4c","side":"left"},{"sibling":"98fc57dfef8873b512edc8340f7181df57302bb96777625e072235c62d7c5895","side":"right"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":134292,"merkle_root":"77fc9c28fae777b81da5b495b3115474df6592dfac590333213d3bdf8b94a9b3","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260515T023701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-05-15T02:37:25Z","sig_algorithm":"ed25519","signature":"68107a834b00b24f5d4501e5ec727445311f132a486567ecc4c72a4e6dff24c8c21f2de3105293353ba5fdbe370d032819af6aa70f694e2e39b6af6737507009","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_55474a24710a5775bfe1ccec20d5923e5d3b8fed790dce683dcf14d269fe86a5"}}