Security operations centers (SOCs) must triage large volumes of alerts, most of which are benign, while missed attacks can remain uninvestigated. Tool-using large language model (LLM) agents can retrieve evidence during triage, but it remains unclear how reasoning strategies determine what to gather and when an investi...
Saimon Amanuel Tsegai, Alex Kantchelian, Dan-Feng Yao et al.· 0 citations
BEACON is an LLM-driven framework for cross-source CTI knowledge graph construction that constructs and releases two human-annotated datasets from 34 sources and outperforms all baselines by at least 23% and 9%, respectively.
AgentFlow, a flow-centric policy language and runtime enforcement model for specifying where data may travel in agent systems, is presented and results are preliminary and scoped to the modeled policy-visible agent behaviors and evaluated benchmarks.
It is argued that this substrate, not model capability, is the bottleneck on agentic CTI investigation, and CTIFoundry, an agent-native corpus scaffold, is presented.
Yutong Cheng, Chang-Ze Li, Q. Cui et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
