INTEL_REPORT
arXiv — Cryptography & Security (cs.CR) · published 5/11/2026, 4:00:00 AM · TLP amber
Summary
Ingested excerpt (first ~500 chars of normalized text).
When the Ruler is Broken: Parsing-Induced Suppression in LLM-Based Security Log Evaluation arXiv:2605.07293v1 Announce Type: new Abstract: LLM-based SOC log classifiers are commonly evaluated using regular-expression pipelines that extract structured fields from free-form model output. We demonstrate that this practice introduces a class of silent, systematic evaluation errors, which we term parsing-induced suppression that can cause a fully functional model to appear comple…
https://arxiv.org/abs/2605.07293
sha256:201b35336ec7ae65e446cf5778dfc73b032ad86ee4e46993347e6766b844964d
What we pulled out
Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).
Indicators
Linked with report → mentions → indicator. Values open the indicator workspace.
No indicators linked for this report.
Malware families
Allowlist token matches only.
Threat actors mentioned
Allowlist mentions — not a formal attribution verdict.
ATT&CK techniques
MITRE IDs referenced in text and present in local technique table.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Browse the report corpus.