2 papers
cs.CR2026
From Production SIEM to Reusable Cybersecurity Artifacts
Sidnei Barbieri, Leonardo Vaz de Meneses, Ãgney Lopes Roth Ferraz +2
Operational evidence is not automatically scientific evidence. The most realistic Security Operations Center (SOC) data is production telemetry, yet it remains scientifically inacc…
cs.CR2026
SOCpilot: Verifying Policy Compliance for LLM-Assisted Incident Response
Sidnei Barbieri, Leonardo Vaz de Meneses, Ãgney Lopes Roth Ferraz +1
Security operations centers (SOCs) are beginning to use large language models (LLMs) as copilots to draft incident-response plans. These plans may include actions that are valid pe…