{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_b3257edaa4c97d86dee406d0e00c2d72f6e8c9a806eeb25df5cc5de53de70db3","bitcoin_anchor":{"bitcoin_attestations":[],"calendar_attestations":[],"ots_url":"","stamped_at":"","status":"pending_next_stamp"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_b3257edaa4c97d86dee406d0e00c2d72f6e8c9a806eeb25df5cc5de53de70db3","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"288bcb98108e31c1775648d2e6b3f9289da297aca7dee518fd0c1560ee3885f3","published":"Fri, 29 May 2026 00:00:00 -0400","receipt_hash":"288bcb98108e31c1775648d2e6b3f9289da297aca7dee518fd0c1560ee3885f3","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"288bcb98108e31c1775648d2e6b3f9289da297aca7dee518fd0c1560ee3885f3","observed_at":"2026-05-29T04:43:58.478092Z","parent_run_hash":"0fcd87efcfe67ccb9952f747541debc16793919a4d20fd71ca0ad5516a0a13ee","published":"Fri, 29 May 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2509.23571v3 Announce Type: replace-cross \nAbstract: As cyber threats continue to grow in scale and sophistication, blue team defenders increasingly require advanced tools to proactively detect and mitigate risks. Large Language Models (LLMs) offer promising capabilities for enhancing threat analysis. However, their effectiveness in real-world blue team threat-hunting scenarios remains insufficiently explored. This paper presents CyberTeam, a benchmark designed to guide LLMs in blue teaming practice. CyberTeam constructs a standardized workflow in two stages. First, it models realistic threat-hunting workflows by capturing the dependencies among analytical tasks from threat attribution to incident response. Next, each task is addressed through a set of operational modules tailored to its specific analytical requirements. This transforms threat hunting into a structured sequence of reasoning steps, with each step grounded in a discrete operation and ordered according to task-speci","title":"Benchmarking LLM-Assisted Blue Teaming via Standardized Threat Hunting","url":"https://arxiv.org/abs/2509.23571","vendor":"arxiv_cs_ai"},"summary":"arXiv:2509.23571v3 Announce Type: replace-cross \nAbstract: As cyber threats continue to grow in scale and sophistication, blue team defenders increasingly require advanced tools to proactively detect and mitigate risks. Large Language Models (LLMs) offer promising capabilities for enhancing threat analysis. However, their effectiveness in real-world blue team threat-hunting scenarios remains insufficiently explored. This paper presents CyberTeam, a benchmark designed to guide LLMs in blue teaming practice. CyberTeam constructs a standardized workflow in two stages. First, it models realistic threat-hunting workflows by capturing the dependencies among analytical tasks from threat attribution to incident response. Next, each task is addressed through a set of operational modules tailored to its specific analytical requirements. This transforms threat hunting into a structured sequence of reasoning steps, with each step grounded in a discrete operation and ordered according to task-speci","title":"Benchmarking LLM-Assisted Blue Teaming via Standardized Threat Hunting","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-05-29T04:43:58Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2509.23571"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:be285558c87b09b81e3b42cdc4f42694a95b0ab1c14dcbc0c121bb26ccc8402726a8765bd1a1f101b9e98a7e05aa13a7f6b76e663789ef04f7322840d0168a0f","signer":"crovia.substrate","subject":{"observed_at":"2026-05-29T04:43:58Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2509.23571"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"fdfd96cdb0bbfb26a750a229f8150214acb9912dd96a6c39ce050fa9d3d5d9bd","leaf_index":158084,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"03fd0887761a7e89ced15f8c2f3dc1ebc05c0dcd4a10b7e3428df1023786038f","side":"right"},{"sibling":"93483b7b55296e21726c534b38b551f88e84f45ba2675056e79b7b1b080280a7","side":"right"},{"sibling":"1a9785d3a9f0074f1c13644cc13b034e266825def099b31ac7891825bf7c9c6e","side":"left"},{"sibling":"f891d45fa0dd51b1eb95ab477ca1665e6d1a89ebd03caeb20832e2c8f4001cb1","side":"right"},{"sibling":"1db6ee1b844c693165ccc6c3864ccc34458ec09c391bf035931731913117bd52","side":"right"},{"sibling":"796de9dd6ef901ab3e49311279a21042b8f2cfbb09b2fbb767544159218def9b","side":"right"},{"sibling":"62988561fabfe452383ec872bd31f27e80fe019c13c67e0ef3aed8f206215007","side":"right"},{"sibling":"463d4726f68bda2bbf724c72553fd53d88ea99a3d4a713f9b8a1b2d9fde12933","side":"left"},{"sibling":"002471ff5893cd2a2890119cbfe4a9456bfb46cf31fa6aee377650afe6ae0c92","side":"left"},{"sibling":"1dcc44e23fbb0218b13591e4b584eca3600dcf365769cb741e0ecd33b25b8c56","side":"right"},{"sibling":"fcf16a6f44025801f5b83e928acce764352ddbc06ae3043d8cde9a409933e6d8","side":"right"},{"sibling":"78982294dee68f9db9288c64d7e507c7865fda96e1b6f7ccff5c8bb152e93c49","side":"left"},{"sibling":"995b421824624a8282c7f44e64c64ee35344800f477ae1845b41be14d3fab94c","side":"right"},{"sibling":"66331bac84ca0f8983eb09fac7eaf95af234f1b82680b793eabff4ee25caac40","side":"left"},{"sibling":"35ca36cee447f0ef7064a25d55f59357c66901e31427729c4c1d8b14aa8adb6c","side":"left"},{"sibling":"eef0e8906a749d3470f89beeedc723f37a5737010bbb0dcc7cf91515338e5a3e","side":"right"},{"sibling":"1a07e481a9407d71aad078ce854cdeee362163c887fe10f889b0ecf0b5e749ad","side":"right"},{"sibling":"d841ad93efda0869e5eb97678f348f03f5caab4353e05ff4bf18f47fb945b822","side":"left"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":158251,"merkle_root":"485e6b31fe60c8beba5b394808c7e4c32448b2ff65c2482c480ca0e2a2eda718","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260529T053701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-05-29T05:37:37Z","sig_algorithm":"ed25519","signature":"bbf9f005201182fce4f9d94c7a9d01a508b56daf7d9611bd73514f5f616bc059d0e5e1f2edfc95716e6fe08ef5fae38b558cbf7f2fd8f9d5dfe4c34a54c83005","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_b3257edaa4c97d86dee406d0e00c2d72f6e8c9a806eeb25df5cc5de53de70db3"}}