CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligence

# An Agent-Native Corpus Scaffold for Cyber Threat Intelligence
Source: [https://arxiv.org/html/2608.18613](https://arxiv.org/html/2608.18613)
Changze LiQian CuiWei Ding\[2pt\]Lingzhi WangYan ChenPeng Gao\[5pt\] Virginia Tech Amazon Northwestern University\[3pt\]\{yutongcheng,changzeli,penggao\}@vt\.edu\{cuiqia,dingwe\}@amazon\.com\[1pt\]LingzhiWang2025@u\.northwestern\.eduychen@northwestern\.edu

###### Abstract

Cyber threat intelligence \(CTI\) is increasingly consumed not by human analysts but by LLM agents that compose multi\-step investigations at query time\. The harness side of this shift has matured rapidly \(planning loops, tool protocols, context management\), but the corpus side has not: threat reports and vulnerability databases are still packaged for retrieval\-augmented generation, as opaque chunks behind an embedding index\. We argue that this substrate, not model capability, is the bottleneck on agentic CTI investigation, and present CTIFoundry, an*agent\-native corpus scaffold*\. At build time, CTIFoundry materializes the latent structure of a CTI corpus: a deterministic ontology graph over four authoritative knowledge bases \(CVE, CWE, CAPEC, ATT&CK\) whose official cross\-references become typed, traversable edges; a span\-grounded report layer whose canonical, alias\-resolved cross\-vendor entities index provenance\-carrying chunks; and hybrid dense\+lexical retrieval surfaces\. At query time this structure is exposed through seven typed tools and three procedural skills mounted on a stock, widely\-used open\-source agent harness\. On the public CTIConnect benchmark \(nine tasks over entity linking, attribution, and multi\-document synthesis\), swapping only the action surface lifts the identically\-harnessed agent from 0\.610 to 0\.829 overall F1 withgpt\-5\.4and from 0\.470 to 0\.745 withclaude\-haiku\-4\-5: a small model on CTIFoundry surpasses a flagship model on the flat substrate\. The accuracy is not bought with search effort: on both Claude models the scaffolded agent is more accurate at roughly half the tool calls per question\. An ablation attributes the gains: typed structure carries the larger share, procedural skills convert structure into discipline, and the two compose super\-additively; skills bind only to structure that exists\. Build\-time validation guarantees zero fabricated identifiers by construction, and the scaffold sustains 1,168 investigations end\-to\-end at≈\\approx2\.6 cents each\.

## 1Introduction

A cyber threat intelligence \(CTI\) investigation is intrinsically multi\-step\. The same adversary appears under different names across vendor reports \(*Lazarus*,*Hidden Cobra*,*APT38*\), so any question about it first requires resolving aliases to one canonical entity\. A behavioral description must then be linked to an authoritative taxonomy \(CVE, CWE, CAPEC, ATT&CK\), usually through an*official cross\-reference*: the CVE record names its CWE weakness, the CAPEC pattern names the ATT&CK technique it maps to\. And a campaign profile is scattered across vendors, each holding a fragment\. Resolve, traverse, collect, reconcile: exactly the kind of tool\-mediated procedure that large language model \(LLM\) agents are built to compose\. The interleaved reason–act loop\([Yao et al\. 2023](https://arxiv.org/html/2608.18613#bib.bib56)\)and learned tool invocation\([Schick et al\. 2023](https://arxiv.org/html/2608.18613#bib.bib43)\)have hardened into a commodity stack of open\-source harnesses\([Yang & mini\-swe\-agent contributors 2025](https://arxiv.org/html/2608.18613#bib.bib54);[Anthropic 2024](https://arxiv.org/html/2608.18613#bib.bib3);[Anthropic 2025b](https://arxiv.org/html/2608.18613#bib.bib5);[Anthropic 2025a](https://arxiv.org/html/2608.18613#bib.bib4)\), and purpose\-built agent–computer interfaces have delivered striking results elsewhere\([Yang et al\. 2024](https://arxiv.org/html/2608.18613#bib.bib55)\)\.

This progress is unbalanced\. The*harness*improves with every release, but dropping a more capable agent into a vertical domain does not produce a capable domain investigator: the agent inherits whatever substrate the domain’s corpora are packaged in\. In CTI that packaging is inherited from retrieval\-augmented generation \(RAG\), opaque chunks behind a single similarity\-search interface\([Lewis et al\. 2020](https://arxiv.org/html/2608.18613#bib.bib24)\), with three consequences\. Vendor aliases are never resolved, so reports about one actor shard across names sharing no surface vocabulary; the official cross\-references that authoritatively answer entity\-linking questions survive only as text inside record blobs; and derived claims carry no span\-level provenance, so nothing separates an authoritative cross\-reference from a textual co\-occurrence\. Putting an agent on top repairs none of it: iterating over an opaque substrate only re\-retrieves, and cannot recover structure that indexing discarded\. The public CTIConnect benchmark\([Cheng et al\. 2026b](https://arxiv.org/html/2608.18613#bib.bib12)\)measured the consequence, and in our own runs a state\-of\-practice harness over the flat corpus cannot follow an official cross\-reference even when it has already retrieved the record carrying it \(Appendix[E\.4](https://arxiv.org/html/2608.18613#A5.SS4)\)\. We distill these gaps into four challenges \(C1–C4, §[2](https://arxiv.org/html/2608.18613#S2)\)\. The binding constraint is the*substrate*, not the agent\.

We present CTIFoundry, an agent\-native corpus scaffold with two halves\. At*build time*it materializes the corpus’s latent structure into typed, validated artifacts \(Table[4](https://arxiv.org/html/2608.18613#A1.T4)\): a deterministic*ontology graph*whose nodes are the entries of four authoritative knowledge bases and whose typed edges are their official cross\-references, built under a zero\-fabrication invariant \(C1\); a*span\-grounded report layer*that chunks vendor reports with exact character\-offset provenance and resolves typed mentions, deterministic signals first, into canonical cross\-vendor entities that key the chunks \(C2\); and*hybrid retrieval surfaces*fusing dense and lexical search under a term filter whose pool\-size feedback the agent can steer \(C3\)\. At*query time*this is exposed through*seven typed tools*, each covering one non\-overlapping capability and self\-described with usage guidance and cost, and*three procedural skills*encoding investigation discipline: resolve before searching, traverse official edges before trusting text similarity, verify every candidate \(C4\)\.

We evaluate on CTIConnect’s nine tasks under a deliberately controlled methodology: both arms run on mini\-swe\-agent\([Yang & mini\-swe\-agent contributors 2025](https://arxiv.org/html/2608.18613#bib.bib54)\), the baseline with its native bash tool over the corpus dumped to flat files, the CTIFoundry arm with only the action surface swapped\. Loop, step budget, temperature, and model are identical, so any gap is attributable to the substrate\. The swap lifts overall F1 from 0\.610 to 0\.829 forgpt\-5\.4and from 0\.470 to 0\.745 forclaude\-haiku\-4\-5, by\+0\.19\+0\.19to\+0\.28\+0\.28across a four\-model, two\-provider panel \(Table[2](https://arxiv.org/html/2608.18613#S4.T2), Figure[1\(a\)](https://arxiv.org/html/2608.18613#S3.F1.sf1)\)\. The*shape*matters as much as the size: the gain concentrates where the benchmark located the RAG bottleneck and vanishes on the one task with no authoritative structure to materialize\. Structure moreover partially substitutes for scale, a small model on CTIFoundry surpasses the flagship on flat files, and is not bought with search effort: on both Claude models the scaffolded agent is more accurate at roughly half the tool calls\.

Contributions\.

1. 1\.*The substrate bottleneck\.*Under a fixed third\-party harness in which the action surface is the sole experimental variable, we show the binding constraint on agentic CTI investigation is the corpus substrate, not agent capability: iteration over a flat substrate cannot recover structure its packaging discarded \(§[2](https://arxiv.org/html/2608.18613#S2), §[4\.1](https://arxiv.org/html/2608.18613#S4.SS1)\)\.
2. 2\.*An agent\-native corpus scaffold\.*We define the scaffold and the harness boundary and realize it as a build\-time pipeline \(ontology graph, span\-grounded canonical entities, hybrid retrieval\) under validated zero\-fabrication invariants, exposed through seven typed tools and three procedural skills \(§[3](https://arxiv.org/html/2608.18613#S3)\)\.
3. 3\.*An empirical study, and what it generalizes to\.*Across nine tasks the swap lifts F1 by\+0\.19\+0\.19to\+0\.28\+0\.28at zero fabricated identifiers and roughly half the tool calls \(§[4](https://arxiv.org/html/2608.18613#S4)\), and a2×22\{\\times\}2ablation shows the two halves compose super\-additively \(§[4\.5](https://arxiv.org/html/2608.18613#S4.SS5)\); structure makes the right investigation possible, procedure makes it reliable, and neither substitutes for the other\. The lesson transfers to any vertical whose corpora carry authoritative reference structure\.

## 2Background and Motivation

Operational CTI knowledge lives in two sources of sharply different shape\. Four community\-maintained taxonomies form the reference backbone \(CVE \(vulnerability instances\), CWE \(weakness classes\), CAPEC \(attack patterns\), and MITRE ATT&CK \(adversary techniques\)\([Strom et al\. 2018](https://arxiv.org/html/2608.18613#bib.bib48)\)\), and crucially they are not four independent lists: they*officially cross\-reference*one another, a CVE record naming the CWE it instantiates, a CAPEC pattern the CWEs it exploits and the ATT&CK techniques it maps to\. For a large class of analyst questions these curated edges are*the*authoritative answer: “which weakness underlies this vulnerability” is not a matter of textual similarity but a recorded edge\. The second source is the narrative layer written by security vendors, whose central entities \(threat actors, malware families, campaigns\) carry*vendor\-specific naming*, so intelligence about one campaign is sharded across reports that share no surface vocabulary \(Appendix[B](https://arxiv.org/html/2608.18613#A2)\)\.

CTIConnect\([Cheng et al\. 2026b](https://arxiv.org/html/2608.18613#bib.bib12)\)operationalizes this workflow as a public benchmark, and is to date the only CTI benchmark that evaluates LLMs with retrieval access to the domain’s knowledge sources rather than closed\-book: 1,859 expert\-verified questions over the four knowledge bases plus 321 report summaries, in nine tasks over three families,*entity linking*\(EL\),*entity attribution*\(EA\), and*multi\-document synthesis*\(MDS\)\. Its evaluation is confined to the RAG setting, and its authors name agentic design over the corpus as the open direction\. Its published diagnostics establish*where*LLM\-over\-CTI fails, and we build on that measurement rather than repeat it \(Appendix[C](https://arxiv.org/html/2608.18613#A3)\): a cross\-source semantic gap widens with the heterogeneity a task must bridge, sinking gold evidence past the typical top\-kkwindow through*aliasing*,*register mismatch*between narrative prose and taxonomy terminology, and*sibling confusion*among lexically adjacent entries, failures that are structural rather than incidental, since general\-purpose retrieval upgrades recover only a fraction of what interventions on vocabulary and entity structure do\. Joined by two demands operational CTI adds \(that every claim be auditable back to the vendor and sentence asserting it, and that the analyst’s procedural discipline is written down nowhere in the corpus\) they give four challenges an agent\-facing substrate must meet, each answered by one CTIFoundry component:

- C1*Materialize the latent structure\.*Canonical cross\-vendor aliases and official cross\-references must become typed records and traversable edges, not phrases to rediscover by similarity search: closing the aliasing and sibling\-confusion gaps at their source\.⇒\\Rightarrowthe deterministic ontology graph and the canonical entity layer \(§[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)\)\.
- C2*Ground every derived assertion in provenance\.*Extracted entities and groundings must point back to exact source spans with vendor attribution, so the agent \(and the build validator\) can verify rather than trust\.⇒\\Rightarrowspan\-grounded chunks under a zero\-fabrication validation regime \(§[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)\)\.
- C3*Speak both retrieval languages\.*Dense search bridges paraphrase; lexical filtering pins rare discriminative tokens; CTI questions routinely need both, and each covers the other’s failure mode, the register mismatch measured above\.⇒\\Rightarrowhybrid dense\+BM25 surfaces with a steerable term filter \(§[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)\)\.
- C4*Ship the analyst’s procedure with the interface\.*Which tool to call first, when an official edge outranks a text match, how to verify a candidate; this discipline is corpus\-specific and must accompany the scaffold, not be rediscovered per query\.⇒\\Rightarrowper\-task\-family procedural skills over self\-described typed tools \(§[3\.3](https://arxiv.org/html/2608.18613#S3.SS3), §[3\.3](https://arxiv.org/html/2608.18613#S3.SS3)\)\.

CTIFoundry’s build\-time layers answer C1–C3; its query\-time skill layer answers C4\. The next section presents both\.

## 3CTIFoundry

\(a\)![Refer to caption](https://arxiv.org/html/2608.18613v1/architecture.png)\(b\)

Figure 1:What the substrate buys, and what produces it\.\(a\) Per\-task F1 of the identically\-harnessed agent on the flat substrate and on CTIFoundry, one radar per model \(§[4\.3](https://arxiv.org/html/2608.18613#S4.SS3)\)\. \(b\) CTIFoundry architecture: a build\-time pipeline and a query\-time surface of seven typed tools and a per\-task\-family skill \(§[3](https://arxiv.org/html/2608.18613#S3)\)\.### 3\.1Problem Formulation

We study*agent\-native corpus scaffolding*: given a domain corpus and a fixed agent loop, build a derived representation of the corpus, and an action surface over it, that maximizes investigation accuracy without modifying the agent\. Every deployed system already has such a representation, however thin \(flat files are a degenerate one, classic RAG’s dense index a weak one, preserving similarity geometry while discarding every other structure the corpus carries\), so what varies is not whether a scaffold exists but how much of the corpus it keeps reachable\. The agent loop above it is increasingly a commodity \(§[5](https://arxiv.org/html/2608.18613#S5)\), and the corpus below is given by the domain; those we hold fixed\.

Corpus\.A CTI corpus isC=R∪KC=R\\cup K, whereRRis a set of vendor reports \(free text with vendor metadata\), andK=Kcve∪Kcwe∪Kcapec∪KattK=K\_\{\\mathrm\{cve\}\}\\cup K\_\{\\mathrm\{cwe\}\}\\cup K\_\{\\mathrm\{capec\}\}\\cup K\_\{\\mathrm\{att\}\}is a set of knowledge\-base records over four authoritative taxonomies, each record carrying a canonical identifier and cross\-references to other taxonomies\.

###### Definition 1\(Scaffold\)\.

A*scaffold*overCCis a derived, validated, indexed representation through which an agent accesses the corpus,

𝖲⁡\(C\)=\(G,X,ℰ,Π,ℐ\),\\mathsf\{S\}\(C\)\\;=\\;\\big\(\\,G,\\;X,\\;\\mathcal\{E\},\\;\\Pi,\\;\\mathcal\{I\}\\,\\big\),the*ontology graph*G=\(V,E\)G=\(V,E\)over KB records and their typed official cross\-reference edges; provenance\-carrying*chunks*XX, each a document span with character offsets;*canonical entities*ℰ\\mathcal\{E\}, each a cluster of report mentions with a vendor\-attributed alias set and optional grounding inVV; the entity indexΠ:ℰ→2X\\Pi:\\mathcal\{E\}\\rightarrow 2^\{X\}; and dense and lexical indexesℐ\\mathcal\{I\}\. It is*admissible*if it fabricates no identifier:ids⁡\(𝖲⁡\(C\)\)⊆ids⁡\(C\)\\mathrm\{ids\}\(\\mathsf\{S\}\(C\)\)\\subseteq\\mathrm\{ids\}\(C\)\.

###### Definition 2\(Harness and action surface\)\.

A*harness*is an agent loopL​⟨m,b,A⟩L\\langle m,b,A\\rangle: a fixed control program parameterized by a modelmm, a step budgetbb, and an*action surface*AA, the operations it may invoke against the scaffold\. It is*corpus\-agnostic*\(LL,mm,bbcarry no knowledge derived fromCC\), so corpus\-derived artifacts reach the agent only throughAAor through prompt\-injected procedural text, a*skill*σ\\sigma\.

### 3\.2The Scaffold

The build produces the three artifacts of Definition[1](https://arxiv.org/html/2608.18613#Thmdefinition1)under a single rule:*the mechanism follows the evidence*\. Where the corpus already records the answer the build parses it, nothing generative intervening; where only prose carries it, in\-context extraction runs bracketed by deterministic guards; where the question merely paraphrases its evidence, matching is delegated to a commodity embedding model\. Appendix[A](https://arxiv.org/html/2608.18613#A1)gives the pipeline stage by stage, with artifact counts, the resolution algorithm, and the operator prompts\.

Ontology graph \(C1\)\.The cross\-references that answer entity\-linking questions are curated by the taxonomy maintainers and shipped inside the released records, so this layer’s task is*lossless preservation*, deterministic parsing from pinned snapshots, no model in the loop\. Two invariants close it\.*Zero fabrication*holds by construction rather than by post\-hoc filtering: an identifier is written only after it validates against the snapshot\.*Closure over the released corpus*: every edge originates in a KB record the baseline retrieves over as well, so the layer contributes representation rather than information, and §[4\.5](https://arxiv.org/html/2608.18613#S4.SS5)prices that representation on its own\.

Report layer \(C2\)\.Vendor prose records nothing explicitly, so where the ontology layer preserves structure this layer must*recover*it\. Two commitments distinguish it from the extraction line it builds on\([Cheng et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib10)\)\. The output schema is dictated by the consumer, an investigating agent retrieves entities and reads chunk text, so the layer emits typed mentions, TTP groundings, and the entity→\\tochunk index, and*no*relational triples, which nothing downstream would follow\. And every generative step is bracketed by a deterministic guard wherever determinism is available, so what the model contributes is recall and what the build guarantees is validity: identifier\-bearing mentions are captured by regex, every T\-id is validated against the ATT&CK snapshot, and entity resolution is a union\-find ordered so deterministic evidence dominates, only exact and span\-verified alias evidence enters the union, which is what stops distinct state actors collapsing into mega\-clusters \(§[4\.2](https://arxiv.org/html/2608.18613#S4.SS2)\)\.

Retrieval surfaces \(C3\)\.The remaining access mode is the one neither parsed structure nor extracted entities can serve: questions that*paraphrase*their evidence\. Paraphrase matching is a commodity, delegated to an off\-the\-shelf embedding model; what the scaffold contributes is the surface around it\. Knowledge\-base search fuses dense and BM25 rankings by reciprocal\-rank fusion\([Cormack et al\. 2009](https://arxiv.org/html/2608.18613#bib.bib15);[Robertson & Zaragoza 2009](https://arxiv.org/html/2608.18613#bib.bib39)\), over which the caller may passmust\_terms, a conjunctive filter, and read back the surviving pool size\. That one field makes the surface*steerable*\(too many hits means add a term, zero means swap a synonym\), turning a one\-shot ranking into an operator the agent controls, and closing the failure mode that defeats purely dense retrieval here: a gold entry sharing rare discriminative tokens with the query yet sitting far from it in embedding space\.

### 3\.3The Action Surface

The scaffold is consumed through seven typed tools that make the right investigation*possible*and three procedural skills that make it*likely*\. The two are not independent contributions:AAis constrained by𝖲\\mathsf\{S\}, so a skill prescribing “traverse the official edge” is inert unless that edge exists, an interaction §[4\.5](https://arxiv.org/html/2608.18613#S4.SS5)measures\.

Seven typed tools\.Access goes through seven typed tools \(Appendix[D](https://arxiv.org/html/2608.18613#A4)\) designed under three rules\.*Non\-overlap*: each exposes exactly one scaffold capability \(resolution, record fetch, ontology traversal, KB search, chunk search, entity\-indexed collection, document read\), so tool choice is never ambiguous\.*Self\-description*: each states when to use it and what it costs\([Anthropic 2025d](https://arxiv.org/html/2608.18613#bib.bib7)\)\.*Structure before similarity*: descriptions encode the substrate’s priority order \(resolve names before querying, prefer an authoritative edge over text search whenever an identifier is known\), so the ordering the build makes possible is the one the surface advertises\.

Procedural skills\.No corpus writes down the analyst’s procedure \(C4\)\. CTIFoundry ships it as three markdown skill files, one per task family, injected into the user turn\. They are advice, not workflow engines, but encode discipline distilled from trajectory analysis of agent failures: for*entity linking*, never search the target taxonomy first, since the question paraphrases one source entry whose official cross\-reference gives the answer; for*attribution*, restate each behavior in the target taxonomy’s idiom and emit a calibrated minimal covering set, because under identifier F1 a spurious identifier costs what a miss does; for*synthesis*, cover the report cluster exhaustively and merge field\-by\-field across vendors\. Each prescription names an action the build made available, binding the two query\-time layers by construction\. The playbooks are reproduced in Appendix[H](https://arxiv.org/html/2608.18613#A8)\.

## 4Evaluation

We ask four questions on the public CTIConnect benchmark\([Cheng et al\. 2026b](https://arxiv.org/html/2608.18613#bib.bib12)\): is the build sound \(RQ1, §[4\.2](https://arxiv.org/html/2608.18613#S4.SS2)\); does it make an*identically\-harnessed*agent more accurate across model families and scales \(RQ2, §[4\.3](https://arxiv.org/html/2608.18613#S4.SS3)\); is that accuracy bought with search effort, and at what cost \(RQ3, §[4\.4](https://arxiv.org/html/2608.18613#S4.SS4)\); and which half, typed structure or procedural skill, carries the gain \(RQ4, §[4\.5](https://arxiv.org/html/2608.18613#S4.SS5)\)? Appendix[E](https://arxiv.org/html/2608.18613#A5)adds accuracy and cost at1\.7×1\.7\\timesthe question volume and a single trajectory traced on both arms\.

### 4\.1Experimental Setup

Benchmark, corpus, and harness\.CTIConnect contains 1,859 expert\-verified questions over nine tasks in three families \(§[2](https://arxiv.org/html/2608.18613#S2)\): entity linking \(EL: RCM, WIM, ATD, ESD\), attribution \(EA: ATA, VCA\), and multi\-document synthesis \(MDS: CSC, TAP, MLA\), over the four knowledge bases and 321 report summaries \(counts in Table[4](https://arxiv.org/html/2608.18613#A1.T4)\)\. We follow its two\-set protocol: a*main set*of 691 questions carries the controlled comparisons \(RQ1, RQ2, RQ4\), a*scale set*of 1,168 the cost and volume studies \(RQ3, Appendix[E\.2](https://arxiv.org/html/2608.18613#A5.SS2)\); prompts, tools, and skills were frozen on a held\-out development slice\. The obvious threat to any “our agent wins” claim is a harness tuned to the proposed substrate, and we remove it by construction: both arms run the stock mini\-swe\-agent\([Yang & mini\-swe\-agent contributors 2025](https://arxiv.org/html/2608.18613#bib.bib54)\)DefaultAgentover exactly this corpus\. The*base agent*is the harness out of the box, with its native single\-bash surface over the corpus dumped to disk, what a practitioner gets today; the*CTIFoundry agent*is the same harness with*only*the action surface swapped for the seven typed tools and three skills of §[3\.3](https://arxiv.org/html/2608.18613#S3.SS3)\. Loop, prompt style, step budget \(20\), temperature, and model are identical, so the action surface is the sole independent variable\. The panel spans two providers and two tiers \(gpt\-5\.4,gpt\-5\.4\-mini,claude\-sonnet\-4\-6,claude\-haiku\-4\-5\), and the build is compiled once under fixed operators, so every CTIFoundry row reads byte\-identical artifacts\.

Metrics\.All query\-time scores are the benchmark’s, computed identically for every arm\. EL and EA use*identifier\-normalized F1*: identifiers in the final answer are normalized \(case, prefix, sub\-technique suffix,T1059\.001vs\.T1059\) into a predicted set and compared against gold\. Two properties carry weight below: the metric is*set\-valued*, so multi\-answer attribution is scored element\-wise, and*symmetric in error type*, so a hedged extra identifier costs exactly what a miss does, recall cannot be bought with unresolved candidates \(Appendix[E\.4](https://arxiv.org/html/2608.18613#A5.SS4)\)\. MDS is scored by the benchmark’s claim\-level judge \(gpt\-5\.4\) with fixed prompt across arms, read at the resolution we audit below\.*Overall*is the unweighted nine\-task mean\. Effort and cost are*measured, not budgeted*: every run serializes its trajectory, from which we recompute calls per question and provider\-reported tokens at list rates\.

### 4\.2RQ1: Build\-Time Quality

Structural validity\.From the 321 reports and four KB snapshots the build materializes 6,044 ontology nodes, 7,097 official edges, 688 provenance\-carrying chunks, and 4,868 canonical entities\. A validator*blocks the build*on three violation classes \(fabricated identifiers, orphan edges, and span violations \(recorded offsets that do not re\-verify byte\-for\-byte against the frozen source\)\), and the shipped build passes with zero\. The first class is impossible by construction rather than filtered post hoc: every identifier is checked against the snapshots at the moment it is written\. End\-to\-end build cost is 1\.42M tokens \($1\.86\), linear in corpus size\.

Entity resolution\.Against the benchmark’s 50 adversary\-centric report clusters \(used only as labels, never at build time\), we select for each gold clusterggthe canonical entityε\\varepsilonwhose report set best matches it and report coverage=\|R⁡\(ε\)∩g\|/\|g\|=\|R\(\\varepsilon\)\\cap g\|/\|g\|, purity=\|R⁡\(ε\)∩g\|/\|R⁡\(ε\)\|=\|R\(\\varepsilon\)\\cap g\|/\|R\(\\varepsilon\)\|, and their harmonic mean\. CTIFoundry reaches 0\.900 / 0\.927 \(F1 0\.913\) with 27 clusters reconstructed exactly, against 0\.840 / 0\.920 \(F1 0\.878\), and 21 for the extraction graph shipped with the benchmark\. The gain is*coverage at unchanged purity*, which is the non\-trivial direction: the cheap way to raise coverage is transitive merging, and it is exactly what the merge discipline of §[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)forbids, admitting only exact and span\-verified alias evidence into the union rules out the mega\-cluster failure mode that sinks the benchmark graph \(its bestAPT42entity spans nine reports at purity 0\.33\)\.

Extraction quality across operators\.Table[1](https://arxiv.org/html/2608.18613#S4.T1)varies the extraction operator over six models \(protocol in Appendix[E\.1](https://arxiv.org/html/2608.18613#A5.SS1)\): flagships reach F10\.859/0\.7920\.859\\,/\\,0\.792\(entity / TTP\), and small operators trail by 10–20 points, but*almost entirely in recall*: they under\-extract rather than invent, the one degradation mode a build pipeline can absorb, since a missing mention costs coverage while a fabricated one would breach the invariant the whole scaffold rests on\.

Judge reliability\.Two auditors with3\+3\{\+\}years of professional CTI experience independently re\-scored a 50\-item MDS sample blind to the judge’s verdicts\. Agreement is close \(Pearsonrr0\.85; mean per\-item absolute difference 0\.06; mean 0\.705 vs\. 0\.713\), i\.e\. agreement on ranking with no strictness offset\. MDS numbers are therefore comparable*across configurations under one judge*, the only comparison we make, and 0\.06 is the resolution at which we read MDS gaps below\.

Table 1:Build\-time extraction quality as the operator model is varied\.bestandsecondmark the best and runner\-up operator per column\.Entity extractionTTP groundingOperator modelPrecRecF1PrecRecF1gpt\-5\.40\.8460\.8720\.8590\.7490\.8410\.792gpt\-5\.4\-mini0\.7080\.7810\.7430\.6110\.6920\.649gpt\-5\.4\-nano0\.6910\.7120\.7010\.5740\.5800\.577claude\-opus\-4\-10\.8490\.7480\.7950\.7270\.7350\.731claude\-sonnet\-4\-60\.7780\.7710\.7750\.6270\.8060\.705claude\-haiku\-4\-50\.7800\.6530\.7110\.5510\.5990\.574
### 4\.3RQ2: Query\-Time Quality

Table 2:Main\-set per\-subtask scores under the two action surfaces; harness, model, budget, and temperature are identical within a model\.bestmarks the better arm per model and task\.ELEAMDSModelConfigRCMWIMATDESDATAVCACSCTAPMLAOverallgpt\-5\.4Base0\.5880\.6600\.3170\.4250\.5230\.4970\.8450\.8300\.8040\.610CTIFoundry1\.0000\.7231\.0000\.9500\.6310\.6250\.8740\.8520\.8020\.829gpt\-5\.4\-miniBase0\.5750\.5110\.3170\.3500\.4560\.6330\.7760\.7930\.6980\.568CTIFoundry0\.9000\.6810\.9250\.9250\.5810\.5330\.7960\.7930\.6870\.758claude\-sonnet\-4\-6Base0\.2780\.7660\.3260\.6110\.4730\.3200\.7530\.7580\.7450\.559CTIFoundry0\.9260\.8080\.8801\.0000\.4690\.5930\.8280\.8400\.6850\.781claude\-haiku\-4\-5Base0\.4910\.2130\.1800\.5000\.3370\.3600\.6960\.7850\.6700\.470CTIFoundry0\.9440\.5321\.0001\.0000\.4980\.4790\.7930\.8130\.6490\.745

The substrate swap lifts overall F1 by\+0\.219\+0\.219\(gpt\-5\.4,0\.610→0\.8290\.610\{\\to\}0\.829\),\+0\.190\+0\.190\(gpt\-5\.4\-mini\),\+0\.222\+0\.222\(claude\-sonnet\-4\-6\), and\+0\.275\+0\.275\(claude\-haiku\-4\-5\) \(Table[2](https://arxiv.org/html/2608.18613#S4.T2), Figure[1\(a\)](https://arxiv.org/html/2608.18613#S3.F1.sf1)\)\. The headline is not the magnitude but the*shape*: the tasks where the gain fails to appear are as informative as those where it saturates\.

The gain tracks materialized structure, and stops where it stops\.On the three forward EL tasks whose official cross\-references the build materializes, the plan collapses to resolve\-then\-traverse and approaches ceiling \(gpt\-5\.4: RCM0\.59→1\.000\.59\{\\to\}1\.00, ATD0\.32→1\.000\.32\{\\to\}1\.00, ESD0\.43→0\.950\.43\{\\to\}0\.95\), withclaude\-haiku\-4\-5reaching a full1\.001\.00on ATD and ESD, the smallest model in the panel saturating tasks on which the flagship scored 0\.32 and 0\.43 over flat files\. At the other extreme, MLA has no authoritative structure to materialize and the task reduces to rewriting the same report text under either surface: the arms are level, within the judge’s0\.060\.06per\-item resolution\. A substrate contribution on MLA too would be the result we could not explain; its absence is the control the argument needs\.

Structure pays even where it does not hold the answer\.EA’s answer is*not*a recorded edge, the scaffold can only anchor the candidate set the model must then discriminate among, yet it still yields\+0\.12\+0\.12to\+0\.14\+0\.14pooled F1 on three of four models\. The single exception,gpt\-5\.4\-minion VCA, is also the one cell where a base arm wins outright\. WIM makes the same point from the other side: it is the one EL task with no forward edge, and base\-arm scores span0\.660\.66to0\.210\.21across the panel, a0\.450\.45spread on a fixed retrieval interface that retrieval cannot explain and*parametric CVE memory*can\. CTIFoundry lifts every model regardless of what it memorized, converting a capability the flat corpus can only borrow from the model into one the substrate supplies\.

The substrate outweighs a capability tier\.Read across rows:claude\-haiku\-4\-5\(0\.745\), andclaude\-sonnet\-4\-6\(0\.781\) on CTIFoundry both beat flagshipgpt\-5\.4on the flat substrate \(0\.610\), by a wider margin than separates flagship from small model*within*either arm\. The effect is largest where model capability is smallest \(\+0\.275\+0\.275vs\.\+0\.219\+0\.219\), so the scaffold does most work where the model does least while remaining large at the frontier, the same accuracy at a fraction of the per\-query model cost, bought once, offline\. The obvious alternative explanation, that CTIFoundry simply searches harder, is tested next and does not survive the trajectories\.

### 4\.4RQ3: Search Effort and Operating Cost

Input tok/qEL16\.3KEA23\.3KMDS10\.4KOutput tok/qEL270EA353MDS741Cost \($\)EL15\.22EA10\.12MDS4\.88\(a\)RCMWIMATDESDATAVCACSCTAPMLAresolve\_entity1\.11\.41\.3get\_entity1\.42\.11\.11\.22\.73\.5ontology\_neighbors1\.11\.91\.01\.11\.1search\_kb1\.12\.91\.11\.02\.02\.3search\_chunkschunks\_mentioningread\_report2\.93\.02\.9skill compliance1\.001\.001\.001\.000\.450\.901\.001\.001\.00\(b\)
Figure 2:Where the query\-time budget goes\.\(a\) Per\-family cost profile over the 1,168\-question scale set \(gpt\-5\.4\), one shade per metric\. \(b\) Mean calls per question by tool and subtask, with skill first\-call compliance beneath\.\(a\)\(b\)
Figure 3:Two diagnostic views of the same runs\.\(a\) Overall F1 against tool calls per question, main set; up and to the left is better \(§[4\.4](https://arxiv.org/html/2608.18613#S4.SS4)\)\. \(b\) The2×22\{\\times\}2ablation over the nine task axes,gpt\-5\.4\(§[4\.5](https://arxiv.org/html/2608.18613#S4.SS5)\)\.Figure[3\(a\)](https://arxiv.org/html/2608.18613#S4.F3.sf1)places every \(model, arm\) cell on the cost/accuracy plane\. On the GPT models the move is essentially vertical \(\+0\.12\+0\.12calls per question for\+0\.219\+0\.219F1 ongpt\-5\.4,\+0\.21\+0\.21for\+0\.190\+0\.190ongpt\-5\.4\-mini\), so a 3% change in effort does not buy a 36% change in accuracy\. On the Claude models it inverts outright:claude\-haiku\-4\-5issues12\.3312\.33calls per question on flat files against5\.095\.09on CTIFoundry, less than half, while gaining\+0\.275\+0\.275F1;claude\-sonnet\-4\-6goes8\.75→4\.398\.75\\to 4\.39for\+0\.222\+0\.222\. The flat\-substrate agent is therefore not under\-searching but*over*\-searching: lacking a traversable structure it re\-probes the corpus and still lands on plausible\-but\-wrong entries\. Within every arm accuracy*decreases*monotonically with call count, so a long call sequence marks an item the agent could not resolve, never an investigation that paid off: and the ablation locates the mechanism, since*w/o skill*issues the most calls of any configuration \(4\.534\.53against CTIFoundry’s3\.683\.68\), and still trails by0\.0830\.083overall\. Cost follows the same logic \(Figure[2\(a\)](https://arxiv.org/html/2608.18613#S4.F2.sf1)\): at≈\\approx2\.6 cents and≈\\approx7 agent\-seconds per investigation a single sweep recovers the one\-time $1\.86 build many times over, and the per\-family profile tracks the design rather than the corpus size\. Figure[2\(b\)](https://arxiv.org/html/2608.18613#S4.F2.sf2)shows the intended plans are the plans the agent runs: forward EL is a tightsearch\_kb→\\toontology\_neighbors→\\toget\_entityspine, while MDS leans onread\_reportand the entity index and never touches the ontology tools; structure used where it exists and ignored where it does not, unprompted by any router \(trajectory in Appendix[E\.4](https://arxiv.org/html/2608.18613#A5.SS4)\)\.

### 4\.5RQ4: Ablation

Table 3:2×22\{\\times\}2ablation of the two additions to the stock harness \(main set,gpt\-5\.4\); the all\-off corner is mini\-swe\-agent itself\.bestandsecondmark best and runner\-up per task\.ELEAMDSConfigRCMWIMATDESDATAVCACSCTAPMLAOverallCTIFoundry \(full\)1\.0000\.7231\.0000\.9500\.6310\.6250\.8740\.8520\.8020\.829w/o skill0\.8100\.7870\.6000\.9750\.5510\.5500\.8310\.8370\.7760\.746w/o tools0\.7500\.6600\.3500\.5000\.6230\.6500\.8760\.8420\.8010\.672w/o skill & tools0\.5880\.6600\.3170\.4250\.5230\.4970\.8450\.8300\.8040\.610

CTIFoundry adds exactly two things to the stock harness \(the typed\-tool surface in place of bash, and the per\-task skill\), and a2×22\{\\times\}2over the same harness, model, and metrics separates them \(Table[3](https://arxiv.org/html/2608.18613#S4.T3), Figure[3\(b\)](https://arxiv.org/html/2608.18613#S4.F3.sf2)\)\. Taken alone, neither is the system\.*Procedure alone*recovers\+0\.062\+0\.062\(0\.672 vs\. 0\.610\): its reading and verification discipline transfers to bash, but its central prescriptions \(resolve, traverse an official edge, consult an alias set\) name actions the flat surface cannot perform\.*Structure alone*reaches 0\.746, with the deficit concentrated exactly where discipline decides the outcome \(ATD 0\.60 vs\. 1\.00, RCM 0\.81 vs\. 1\.00 once the skill is added\); trajectories show the undisciplined agent searching the*target*taxonomy directly and landing on plausible\-but\-wrong entries\. The composition is the finding:\+0\.062\+0\.062and\+0\.136\+0\.136separately but\+0\.219\+0\.219together \(0\.610→0\.746→0\.8290\.610\\to 0\.746\\to 0\.829\), super\-additive rather than the\+0\.198\+0\.198independent contributions would predict, the interaction §[3\.3](https://arxiv.org/html/2608.18613#S3.SS3)anticipated, and the reason neither an off\-the\-shelf skill library nor a richer index would substitute for the other half\. A deployment finding falls out alongside: identical skill text placed in the system prompt was under\-followed by smaller models yet followed reliably in the user turn, which we attribute to instruction\-following asymmetries in current models rather than to anything CTI\-specific; all runs inject skills in the user turn\.

## 5Related Work

Structuring CTI\.Turning reports into structure has moved from indicator mining\([Liao et al\. 2016](https://arxiv.org/html/2608.18613#bib.bib28)\)through bespoke behavior\-extraction pipelines\([Husari et al\. 2017](https://arxiv.org/html/2608.18613#bib.bib20);[Zhu & Dumitras 2018](https://arxiv.org/html/2608.18613#bib.bib61);[Satvat et al\. 2021](https://arxiv.org/html/2608.18613#bib.bib42);[Li et al\. 2022](https://arxiv.org/html/2608.18613#bib.bib27);[Alam et al\. 2023](https://arxiv.org/html/2608.18613#bib.bib1)\)to LLM\-based construction\([Cheng et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib10)\), alongside unified graphs over the taxonomies themselves\([Strom et al\. 2018](https://arxiv.org/html/2608.18613#bib.bib48);[OASIS 2021](https://arxiv.org/html/2608.18613#bib.bib33);[Hemberg et al\. 2021](https://arxiv.org/html/2608.18613#bib.bib19)\)\. All treat extraction as the endpoint, so the product is a static analytic asset\. CTIFoundry takes extraction quality as a solved input and asks instead what shape structure must take to be*traversed*by an investigating agent\. Evaluation has meanwhile moved from representation quality\([Ranade et al\. 2021](https://arxiv.org/html/2608.18613#bib.bib37)\)through closed\-book probes\([Alam et al\. 2024](https://arxiv.org/html/2608.18613#bib.bib2)\)to CTIConnect\([Cheng et al\. 2026b](https://arxiv.org/html/2608.18613#bib.bib12)\), the corpus\-grounded setting we adopt unchanged\.

Agent harnesses and scaffolds\.The reason–act loop\([Yao et al\. 2023](https://arxiv.org/html/2608.18613#bib.bib56)\)and learned tool invocation\([Schick et al\. 2023](https://arxiv.org/html/2608.18613#bib.bib43)\)have hardened into purpose\-built agent–computer interfaces\([Yang et al\. 2024](https://arxiv.org/html/2608.18613#bib.bib55);[Yang & mini\-swe\-agent contributors 2025](https://arxiv.org/html/2608.18613#bib.bib54);[Anthropic 2024](https://arxiv.org/html/2608.18613#bib.bib3);[Anthropic 2025d](https://arxiv.org/html/2608.18613#bib.bib7);[Anthropic 2025a](https://arxiv.org/html/2608.18613#bib.bib4)\)and deployable skills\([Anthropic 2025c](https://arxiv.org/html/2608.18613#bib.bib6);[Wang et al\. 2024](https://arxiv.org/html/2608.18613#bib.bib52);[Zhang et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib59);[Cheng et al\. 2026a](https://arxiv.org/html/2608.18613#bib.bib11);[Wang et al\. 2023](https://arxiv.org/html/2608.18613#bib.bib51);[Shinn et al\. 2023](https://arxiv.org/html/2608.18613#bib.bib45)\), which self\-evolving agents now rewrite for themselves\([Lee et al\. 2026](https://arxiv.org/html/2608.18613#bib.bib23);[Zhang et al\. 2026](https://arxiv.org/html/2608.18613#bib.bib58);[Lou et al\. 2026](https://arxiv.org/html/2608.18613#bib.bib32);[Lin et al\. 2026](https://arxiv.org/html/2608.18613#bib.bib29);[Chen et al\. 2026a](https://arxiv.org/html/2608.18613#bib.bib8)\)\. Throughout, the editable layer is the*harness*\(prompts, skills, control logic, and the tools’ code\) while the substrate underneath stays whatever the corpus was packaged as\. A tool an agent writes for itself composes only what that substrate affords; it cannot author an edge the corpus never materialized\. CTIFoundry therefore holds the harness fixed and rebuilds what it acts on\. Appendix[F](https://arxiv.org/html/2608.18613#A6)situates this against agentic and deep\-research retrieval, LLM\-augmented data management and knowledge\-base construction, and conversational memory stores\.

## 6Conclusion

CTI investigation is multi\-step by nature, and the agents now asked to perform it are only as good as the substrate they investigate\. This paper presented CTIFoundry, an agent\-native corpus scaffold that materializes at build time what analysts traverse at query time \(authoritative cross\-reference edges, canonical cross\-vendor entities with span\-level provenance, and dual dense\+lexical retrieval surfaces\), exposed through typed tools and procedural skills on a stock agent harness\. Swapping only the action surface improves the same agent by\+0\.19\+0\.19to\+0\.28\+0\.28overall F1 across a four\-model panel, at matched or lower search effort, and the ablation completes the account: structure makes the right investigation possible, procedure makes it reliable, neither substitutes for the other\. The claim extends past CTI: for any domain whose corpora carry authoritative reference structure, the highest\-leverage investment in agent quality may not be a better agent at all, but a corpus deliberately built to be investigated\.

### AI use statement

In this work, we used generative AI tools as an object of study and as a component of the system: the models named in §[4\.1](https://arxiv.org/html/2608.18613#S4.SS1)are the operator models of the build pipeline and the agents under evaluation, and their use is documented in full in §[3](https://arxiv.org/html/2608.18613#S3)and §[4](https://arxiv.org/html/2608.18613#S4)\. We additionally used generative AI assistance for writing support \(copy\-editing and LaTeX formatting\), and for coding support during implementation of the build pipeline and evaluation scripts\. We did not use generative AI tools to generate research ideas, to produce experimental results, or to write or select the related work\. All AI\-assisted code was reviewed and tested by the authors, and all reported numbers come from executed runs\. We have reviewed all AI\-assisted work and take responsibility for the final content of this paper, including its text, claims, and artifacts\.

### Ethics statement

This work studies public cyber threat intelligence: the four community\-maintained taxonomies \(CVE, CWE, CAPEC, ATT&CK\), and the vendor report summaries released with the public CTIConnect benchmark\([Cheng et al\. 2026b](https://arxiv.org/html/2608.18613#bib.bib12)\)\. No human subjects, no private or personally identifying data, and no proprietary victim data are involved, and no new attack capability is created: CTIFoundry reorganizes already\-public defensive reference material into a form an analyst\-facing agent can traverse, and the artifact is intended for defensive triage and attribution\. The residual dual\-use consideration is that faster, better\-grounded navigation of public CTI is available to any reader, which we judge to be outweighed by the defensive benefit, since the same material is already public and the scaffold adds no non\-public knowledge\. CTIFoundry’s outputs are decision support, not adjudication: attribution claims carry span\-level provenance precisely so that a human analyst can audit them, and should not be treated as established fact without that review\. The authors declare no conflicts of interest\.

### Reproducibility statement

The scaffold construction is specified in §[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)\(ontology graph, span\-grounded report layer, hybrid retrieval surfaces\) with the validation invariants it is built under, and the query\-time surface, the seven typed tools and the three procedural skills, in §[3\.3](https://arxiv.org/html/2608.18613#S3.SS3)and Table[5](https://arxiv.org/html/2608.18613#A4.T5)\. The evaluation protocol, including the harness \(mini\-swe\-agent\), the step budget, the temperature, the model versions, and the scoring procedure for each of the nine CTIConnect tasks, is given in §[4\.1](https://arxiv.org/html/2608.18613#S4.SS1); both arms share every setting except the action surface, which is the sole experimental variable\. All corpora are public: the CTIConnect benchmark and its released corpus\([Cheng et al\. 2026b](https://arxiv.org/html/2608.18613#bib.bib12)\), and the four upstream knowledge bases\. Source code for the build pipeline, the tool server, and the skill files, together with the evaluation harness, is submitted as anonymized supplementary material and will be released publicly upon publication\.

#### Acknowledgments

Omitted for double\-blind review\.

## References

- Alam et al\. \(2023\)Md Tanvirul Alam, Dipkamal Bhusal, Youngja Park, and Nidhi Rastogi\.Looking beyond IoCs: Automatically extracting attack patterns from external CTI\.In*RAID*, 2023\.
- Alam et al\. \(2024\)Md Tanvirul Alam, Dipkamal Bhusal, Le Nguyen, and Nidhi Rastogi\.CTIBench: A benchmark for evaluating LLMs in cyber threat intelligence\.In*Advances in Neural Information Processing Systems \(NeurIPS\), Datasets and Benchmarks Track*, 2024\.
- Anthropic \(2024\)Anthropic\.Model context protocol\.[https://modelcontextprotocol\.io](https://modelcontextprotocol.io/), 2024\.
- Anthropic \(2025a\)Anthropic\.Effective context engineering for AI agents\.[https://www\.anthropic\.com/engineering/effective\-context\-engineering\-for\-ai\-agents](https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents), 2025a\.
- Anthropic \(2025b\)Anthropic\.Effective harnesses for long\-running agents\.[https://www\.anthropic\.com/engineering/effective\-harnesses\-for\-long\-running\-agents](https://www.anthropic.com/engineering/effective-harnesses-for-long-running-agents), 2025b\.
- Anthropic \(2025c\)Anthropic\.Equipping agents for the real world with agent skills\.[https://www\.anthropic\.com/engineering/equipping\-agents\-for\-the\-real\-world\-with\-agent\-skills](https://www.anthropic.com/engineering/equipping-agents-for-the-real-world-with-agent-skills), 2025c\.
- Anthropic \(2025d\)Anthropic\.Writing effective tools for agents — with agents\.[https://www\.anthropic\.com/engineering/writing\-tools\-for\-agents](https://www.anthropic.com/engineering/writing-tools-for-agents), 2025d\.
- Chen et al\. \(2026a\)Mingju Chen, Can Lv, Guibin Zhang, Heng Chang, and Shiji Zhou\.Harnessforge: Joint harness and policy evolution for adaptive agent systems\.*arXiv preprint arXiv:2606\.01779*, 2026a\.
- Chen et al\. \(2026b\)Zijian Chen, Xueguang Ma, Shengyao Zhuang, Ping Nie, Kai Zou, Andrew Liu, Joshua Green, Kshama Patel, Ruoxi Meng, Mingyi Su, Sahel Sharifymoghaddam, Yanxi Li, Haoran Hong, Xinyu Shi, Xuye Liu, Nandan Thakur, Crystina Zhang, Luyu Gao, Wenhu Chen, and Jimmy Lin\.BrowseComp\-Plus: A more fair and transparent evaluation benchmark of deep\-research agent\.In*Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(ACL\)*, 2026b\.
- Cheng et al\. \(2025\)Yutong Cheng, Osama Bajaber, Saimon Amanuel Tsegai, Dawn Song, and Peng Gao\.CTINexus: Automatic cyber threat intelligence knowledge graph construction using large language models\.In*IEEE European Symposium on Security and Privacy \(EuroS&P\)*, pp\. 923–938, 2025\.
- Cheng et al\. \(2026a\)Yutong Cheng, Haifeng Chen, Wenchao Yu, Xujiang Zhao, Peng Gao, and Wei Cheng\.Escaping whack\-a\-mole: Optimizing documentation as repo\-specific playbooks for coding agents\.In*Proceedings of the 43rd International Conference on Machine Learning \(ICML\)*, 2026a\.
- Cheng et al\. \(2026b\)Yutong Cheng, Yang Liu, Changze Li, Dawn Song, and Peng Gao\.CTIConnect: A benchmark for retrieval\-augmented LLMs over heterogeneous cyber threat intelligence\.In*Proceedings of the 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining \(KDD ’26\)*\. ACM, 2026b\.doi:10\.1145/3770855\.3817527\.
- Chhikara et al\. \(2025\)Prateek Chhikara, Dev Khant, Saket Aryan, Taranjeet Singh, and Deshraj Yadav\.Mem0: Building production\-ready AI agents with scalable long\-term memory\.*arXiv:2504\.19413*, 2025\.
- Christophides et al\. \(2020\)Vassilis Christophides, Vasilis Efthymiou, Themis Palpanas, George Papadakis, and Kostas Stefanidis\.An overview of end\-to\-end entity resolution for big data\.*ACM Computing Surveys*, 53\(6\), 2020\.
- Cormack et al\. \(2009\)Gordon V\. Cormack, Charles L\. A\. Clarke, and Stefan Buettcher\.Reciprocal rank fusion outperforms Condorcet and individual rank learning methods\.In*SIGIR*, 2009\.
- Edge et al\. \(2024\)Darren Edge, Ha Trinh, Newman Cheng, Joshua Bradley, Alex Chao, Apurva Mody, Steven Truitt, Dasha Metropolitansky, Robert Osazuwa Ness, and Jonathan Larson\.From local to global: A graph RAG approach to query\-focused summarization\.*arXiv:2404\.16130*, 2024\.
- Guo et al\. \(2024\)Zirui Guo, Lianghao Xia, Yanhua Yu, Tu Ao, and Chao Huang\.LightRAG: Simple and fast retrieval\-augmented generation\.*arXiv:2410\.05779*, 2024\.
- Gutiérrez et al\. \(2024\)Bernal Jiménez Gutiérrez, Yiheng Shu, Yu Gu, Michihiro Yasunaga, and Yu Su\.HippoRAG: Neurobiologically inspired long\-term memory for large language models\.In*NeurIPS*, pp\. 59532–59569, 2024\.
- Hemberg et al\. \(2021\)Erik Hemberg, Jonathan Kelly, Michal Shlapentokh\-Rothman, Bryn Reinstadler, Katherine Xu, Nick Rutar, and Una\-May O’Reilly\.Linking threat tactics, techniques, and patterns with defensive weaknesses, vulnerabilities and affected platform configurations for cyber hunting \(BRON\)\.*arXiv:2010\.00533*, 2021\.
- Husari et al\. \(2017\)Ghaith Husari, Ehab Al\-Shaer, Mohiuddin Ahmed, Bill Chu, and Xi Niu\.TTPDrill: Automatic and accurate extraction of threat actions from unstructured text of CTI sources\.In*ACSAC*, pp\. 103–115, 2017\.
- Jiang et al\. \(2023\)Jinhao Jiang, Kun Zhou, Zican Dong, Keming Ye, Wayne Xin Zhao, and Ji\-Rong Wen\.StructGPT: A general framework for large language model to reason over structured data\.In*Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing \(EMNLP\)*, pp\. 9237–9251, 2023\.
- Jin et al\. \(2025\)Bowen Jin, Hansi Zeng, Zhenrui Yue, Jinsung Yoon, Sercan Ö\. Arik, Dong Wang, Hamed Zamani, and Jiawei Han\.Search\-r1: Training LLMs to reason and leverage search engines with reinforcement learning\.*arXiv preprint arXiv:2503\.09516*, 2025\.
- Lee et al\. \(2026\)Yoonho Lee, Roshen Nair, Qizheng Zhang, Kangwook Lee, Omar Khattab, and Chelsea Finn\.Meta\-harness: End\-to\-end optimization of model harnesses\.*arXiv preprint arXiv:2603\.28052*, 2026\.
- Lewis et al\. \(2020\)Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen\-tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela\.Retrieval\-augmented generation for knowledge\-intensive NLP tasks\.In*NeurIPS*, pp\. 9459–9474, 2020\.
- Li et al\. \(2024\)Guoliang Li, Xuanhe Zhou, and Xinyang Zhao\.LLM for data management\.*Proceedings of the VLDB Endowment*, 17\(12\):4213–4216, 2024\.doi:10\.14778/3685800\.3685838\.
- Li et al\. \(2025\)Xiaoxi Li, Jiajie Jin, Guanting Dong, Hongjin Qian, Yutao Zhu, Yongkang Wu, Ji\-Rong Wen, and Zhicheng Dou\.WebThinker: Empowering large reasoning models with deep research capability\.In*Advances in Neural Information Processing Systems \(NeurIPS\)*, 2025\.
- Li et al\. \(2022\)Zhenyuan Li, Jun Zeng, Yan Chen, and Zhenkai Liang\.AttacKG: Constructing technique knowledge graph from cyber threat intelligence reports\.In*ESORICS*, pp\. 589–609, 2022\.
- Liao et al\. \(2016\)Xiaojing Liao, Kan Yuan, XiaoFeng Wang, Zhou Li, Luyi Xing, and Raheem Beyah\.Acing the IOC game: Toward automatic discovery and analysis of open\-source cyber threat intelligence\.In*ACM CCS*, 2016\.
- Lin et al\. \(2026\)Minhua Lin, Juncheng Wu, Zijun Wang, Zhan Shi, Yisi Sang, Bing He, Zewen Liu, Tianxin Wei, Zongyu Wu, Zhiwei Zhang, Dakuo Wang, Xiang Zhang, Benoit Dumoulin, Cihang Xie, Yuyin Zhou, Suhang Wang, and Hanqing Lu\.Harness updating is not harness benefit: Disentangling evolution capabilities in self\-evolving LLM agents\.*arXiv preprint arXiv:2605\.30621*, 2026\.
- Lin et al\. \(2024\)Yiming Lin, Madelon Hulsebos, Ruiying Ma, Shreya Shankar, Sepanta Zeighami, Aditya G\. Parameswaran, and Eugene Wu\.Towards accurate and efficient document analytics with large language models\.*arXiv preprint arXiv:2405\.04674*, 2024\.
- Liu et al\. \(2025\)Chunwei Liu, Matthew Russo, Michael Cafarella, Lei Cao, Peter Baile Chen, Zui Chen, Michael Franklin, Tim Kraska, Samuel Madden, Rana Shahout, and Gerardo Vitagliano\.Palimpzest: Optimizing AI\-powered analytics with declarative query processing\.In*Conference on Innovative Data Systems Research \(CIDR\)*, 2025\.
- Lou et al\. \(2026\)Xinghua Lou, Miguel Lázaro\-Gredilla, Antoine Dedieu, Carter Wendelken, Wolfgang Lehrach, and Kevin P\. Murphy\.Autoharness: Improving LLM agents by automatically synthesizing a code harness\.*arXiv preprint arXiv:2603\.03329*, 2026\.
- OASIS \(2021\)OASIS\.STIX version 2\.1: Structured threat information expression\.OASIS Standard, 2021\.
- Packer et al\. \(2023\)Charles Packer, Sarah Wooders, Kevin Lin, Vivian Fang, Shishir G\. Patil, Ion Stoica, and Joseph E\. Gonzalez\.MemGPT: Towards LLMs as operating systems\.*arXiv:2310\.08560*, 2023\.
- Patel et al\. \(2025\)Liana Patel, Siddharth Jha, Melissa Pan, Harshit Gupta, Parth Asawa, Carlos Guestrin, and Matei Zaharia\.Semantic operators and their optimization: Enabling LLM\-based data processing with accuracy guarantees in LOTUS\.*Proceedings of the VLDB Endowment*, 18\(11\):4171–4184, 2025\.doi:10\.14778/3749646\.3749685\.
- Putra et al\. \(2026\)Rizky Ramadhana Putra, Raihan Sultan Pasha Basuki, Yutong Cheng, and Peng Gao\.NL2Logic: AST\-guided translation of natural language into first\-order logic with large language models\.In*Findings of the Association for Computational Linguistics: EACL 2026*, pp\. 6035–6051\. Association for Computational Linguistics, 2026\.doi:10\.18653/v1/2026\.findings\-eacl\.317\.URL[http://dx\.doi\.org/10\.18653/v1/2026\.findings\-eacl\.317](http://dx.doi.org/10.18653/v1/2026.findings-eacl.317)\.
- Ranade et al\. \(2021\)Priyanka Ranade, Aritran Piplai, Anupam Joshi, and Tim Finin\.CyBERT: Contextualized embeddings for the cybersecurity domain\.In*IEEE International Conference on Big Data \(Big Data\)*, pp\. 3334–3342, 2021\.doi:10\.1109/BigData52589\.2021\.9671824\.
- Rasmussen et al\. \(2025\)Preston Rasmussen, Pavlo Paliychuk, Travis Beauvais, Jack Ryan, and Daniel Chalef\.Zep: A temporal knowledge graph architecture for agent memory\.*arXiv:2501\.13956*, 2025\.
- Robertson & Zaragoza \(2009\)Stephen Robertson and Hugo Zaragoza\.The probabilistic relevance framework: BM25 and beyond\.*Foundations and Trends in Information Retrieval*, 3\(4\), 2009\.
- Russo et al\. \(2025\)Matthew Russo, Sivaprasad Sudhir, Gerardo Vitagliano, Chunwei Liu, Tim Kraska, Samuel Madden, and Michael Cafarella\.Abacus: A cost\-based optimizer for semantic operator systems\.*arXiv preprint arXiv:2505\.14661*, 2025\.
- Sarthi et al\. \(2024\)Parth Sarthi, Salman Abdullah, Aditi Tuli, Shubh Khanna, Anna Goldie, and Christopher D\. Manning\.RAPTOR: Recursive abstractive processing for tree\-organized retrieval\.In*ICLR*, 2024\.
- Satvat et al\. \(2021\)Kiavash Satvat, Rigel Gjomemo, and V\. N\. Venkatakrishnan\.EXTRACTOR: Extracting attack behavior from threat reports\.In*IEEE EuroS&P*, pp\. 598–615, 2021\.
- Schick et al\. \(2023\)Timo Schick, Jane Dwivedi\-Yu, Roberto Dessì, Roberta Raileanu, Maria Lomeli, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom\.Toolformer: Language models can teach themselves to use tools\.In*NeurIPS*, 2023\.
- Shankar et al\. \(2025\)Shreya Shankar, Tristan Chambers, Tarak Shah, Aditya G\. Parameswaran, and Eugene Wu\.DocETL: Agentic query rewriting and evaluation for complex document processing\.*Proceedings of the VLDB Endowment*, 18\(9\):3035–3048, 2025\.doi:10\.14778/3746405\.3746426\.
- Shinn et al\. \(2023\)Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao\.Reflexion: Language agents with verbal reinforcement learning\.In*NeurIPS*, 2023\.
- Singh et al\. \(2025\)Aditi Singh, Abul Ehtesham, Saket Kumar, and Tala Talaei Khoei\.Agentic retrieval\-augmented generation: A survey on agentic RAG\.*arXiv:2501\.09136*, 2025\.
- Song et al\. \(2025\)Huatong Song, Jinhao Jiang, Yingqian Min, Jie Chen, Zhipeng Chen, Wayne Xin Zhao, Lei Fang, and Ji\-Rong Wen\.R1\-Searcher: Incentivizing the search capability in LLMs via reinforcement learning\.*arXiv preprint arXiv:2503\.05592*, 2025\.
- Strom et al\. \(2018\)Blake E\. Strom, Andy Applebaum, Doug P\. Miller, Kathryn C\. Nickels, Adam G\. Pennington, and Cody B\. Thomas\.MITRE ATT&CK: Design and philosophy\.Technical Report MTR170302, The MITRE Corporation, 2018\.
- Sun et al\. \(2025\)Hao Sun, Zile Qiao, Jiayan Guo, Xuanbo Fan, Yingyan Hou, Yong Jiang, Pengjun Xie, Yan Zhang, Fei Huang, and Jingren Zhou\.ZeroSearch: Incentivize the search capability of LLMs without searching\.*arXiv preprint arXiv:2505\.04588*, 2025\.
- Sun et al\. \(2024\)Jiashuo Sun, Chengjin Xu, Lumingyuan Tang, Saizhuo Wang, Chen Lin, Yeyun Gong, Lionel M\. Ni, Heung\-Yeung Shum, and Jian Guo\.Think\-on\-graph: Deep and responsible reasoning of large language model on knowledge graph\.In*International Conference on Learning Representations \(ICLR\)*, 2024\.
- Wang et al\. \(2023\)Guanzhi Wang, Yuqi Xie, Yunfan Jiang, Ajay Mandlekar, Chaowei Xiao, Yuke Zhu, Linxi Fan, and Anima Anandkumar\.Voyager: An open\-ended embodied agent with large language models\.*arXiv:2305\.16291*, 2023\.
- Wang et al\. \(2024\)Zora Zhiruo Wang, Jiayuan Mao, Daniel Fried, and Graham Neubig\.Agent workflow memory\.*arXiv preprint arXiv:2409\.07429*, 2024\.
- Wu et al\. \(2018\)Sen Wu, Luke Hsiao, Xiao Cheng, Braden Hancock, Theodoros Rekatsinas, Philip Levis, and Christopher Ré\.Fonduer: Knowledge base construction from richly formatted data\.In*SIGMOD*, pp\. 1301–1316, 2018\.
- Yang & mini\-swe\-agent contributors \(2025\)John Yang and mini\-swe\-agent contributors\.mini\-swe\-agent: a minimal, standard agent harness\.[https://github\.com/SWE\-agent/mini\-swe\-agent](https://github.com/SWE-agent/mini-swe-agent), 2025\.
- Yang et al\. \(2024\)John Yang, Carlos E\. Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Press\.SWE\-agent: Agent\-computer interfaces enable automated software engineering\.In*NeurIPS*, 2024\.
- Yao et al\. \(2023\)Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao\.ReAct: Synergizing reasoning and acting in language models\.In*ICLR*, 2023\.
- Zhang et al\. \(2017\)Ce Zhang, Christopher Ré, Michael Cafarella, Christopher De Sa, Alex Ratner, Jaeho Shin, Feiran Wang, and Sen Wu\.DeepDive: Declarative knowledge base construction\.*Communications of the ACM*, 60\(5\):93–102, 2017\.
- Zhang et al\. \(2026\)Hangfan Zhang, Shao Zhang, Kangcong Li, Chen Zhang, Yang Chen, Yiqun Zhang, Lei Bai, and Shuyue Hu\.Self\-harness: Harnesses that improve themselves\.*arXiv preprint arXiv:2606\.09498*, 2026\.
- Zhang et al\. \(2025\)Qizheng Zhang, Changran Hu, Shubhangi Upasani, Boyuan Ma, Fenglu Hong, Vamsidhar Kamanuru, Jay Rainton, Chen Wu, Mengmeng Ji, Hanchen Li, Urmish Thakker, James Zou, and Kunle Olukotun\.Agentic context engineering: Evolving contexts for self\-improving language models\.*arXiv preprint arXiv:2510\.04618*, 2025\.
- Zheng et al\. \(2025\)Yuxiang Zheng, Dayuan Fu, Xiangkun Hu, Xiaojie Cai, Lyumanshan Ye, Pengrui Lu, and Pengfei Liu\.DeepResearcher: Scaling deep research via reinforcement learning in real\-world environments\.*arXiv preprint arXiv:2504\.03160*, 2025\.
- Zhu & Dumitras \(2018\)Ziyun Zhu and Tudor Dumitras\.ChainSmith: Automatically learning the semantics of malicious campaigns by mining threat intelligence reports\.In*IEEE EuroS&P*, pp\. 458–472, 2018\.

###### Appendix Contents

1. [1Introduction](https://arxiv.org/html/2608.18613#S1)
2. [2Background and Motivation](https://arxiv.org/html/2608.18613#S2)
3. [3CTIFoundry](https://arxiv.org/html/2608.18613#S3)1. [3\.1Problem Formulation](https://arxiv.org/html/2608.18613#S3.SS1) 2. [3\.2The Scaffold](https://arxiv.org/html/2608.18613#S3.SS2) 3. [3\.3The Action Surface](https://arxiv.org/html/2608.18613#S3.SS3)
4. [4Evaluation](https://arxiv.org/html/2608.18613#S4)1. [4\.1Experimental Setup](https://arxiv.org/html/2608.18613#S4.SS1) 2. [4\.2RQ1: Build\-Time Quality](https://arxiv.org/html/2608.18613#S4.SS2) 3. [4\.3RQ2: Query\-Time Quality](https://arxiv.org/html/2608.18613#S4.SS3) 4. [4\.4RQ3: Search Effort and Operating Cost](https://arxiv.org/html/2608.18613#S4.SS4) 5. [4\.5RQ4: Ablation](https://arxiv.org/html/2608.18613#S4.SS5)
5. [5Related Work](https://arxiv.org/html/2608.18613#S5)
6. [6Conclusion](https://arxiv.org/html/2608.18613#S6)
7. [References](https://arxiv.org/html/2608.18613#bib)
8. [AThe Build Pipeline in Detail](https://arxiv.org/html/2608.18613#A1)1. [A\.1Report Layer: the Four Stages](https://arxiv.org/html/2608.18613#A1.SS1) 2. [A\.2Embedding Model and Indexes](https://arxiv.org/html/2608.18613#A1.SS2) 3. [A\.3Deterministic\-First Entity Resolution](https://arxiv.org/html/2608.18613#A1.SS3)
9. [BThe CTI Ecosystem](https://arxiv.org/html/2608.18613#A2)
10. [CCTIConnect’s Measured Failure Diagnostics](https://arxiv.org/html/2608.18613#A3)
11. [DThe Seven Typed Tools](https://arxiv.org/html/2608.18613#A4)
12. [EAdditional Experimental Results](https://arxiv.org/html/2608.18613#A5)1. [E\.1RQ1: Extraction Quality Across Operator Models](https://arxiv.org/html/2608.18613#A5.SS1) 2. [E\.2Scalability at1\.7×1\.7\\timesthe Question Volume](https://arxiv.org/html/2608.18613#A5.SS2) 3. [E\.3RQ4: Scalability](https://arxiv.org/html/2608.18613#A5.SS3) 4. [E\.4A Qualitative Case Study](https://arxiv.org/html/2608.18613#A5.SS4) 5. [E\.5RQ6: A Qualitative Case Study](https://arxiv.org/html/2608.18613#A5.SS5)
13. [FExtended Related Work](https://arxiv.org/html/2608.18613#A6)1. [F\.1CTI Knowledge Extraction and Representation](https://arxiv.org/html/2608.18613#A6.SS1) 2. [F\.2From Retrieval Pipelines to Agentic Search](https://arxiv.org/html/2608.18613#A6.SS2) 3. [F\.3LLM\-Augmented Data Management and Knowledge\-Base Construction](https://arxiv.org/html/2608.18613#A6.SS3) 4. [F\.4Agent Interfaces, Skills, and Context Engineering](https://arxiv.org/html/2608.18613#A6.SS4) 5. [F\.5CTI and Security Benchmarks on LLM](https://arxiv.org/html/2608.18613#A6.SS5)
14. [GPrompt Templates](https://arxiv.org/html/2608.18613#A7)1. [G\.1Agent System Prompts: the Two Arms](https://arxiv.org/html/2608.18613#A7.SS1) 2. [G\.2Build Time: Span\-Grounded Extraction](https://arxiv.org/html/2608.18613#A7.SS2) 3. [G\.3Build Time: TTP Extraction](https://arxiv.org/html/2608.18613#A7.SS3) 4. [G\.4Build Time: Entity\-Resolution Adjudication](https://arxiv.org/html/2608.18613#A7.SS4) 5. [G\.5Build Time: Triple Validation](https://arxiv.org/html/2608.18613#A7.SS5) 6. [G\.6Evaluation: Multi\-Document Synthesis Judge](https://arxiv.org/html/2608.18613#A7.SS6)
15. [HProcedural Skill Playbooks](https://arxiv.org/html/2608.18613#A8)1. [H\.1Entity Linking \(RCM, ATD, ESD\)](https://arxiv.org/html/2608.18613#A8.SS1) 2. [H\.2Entity Linking, Reverse Direction \(WIM\)](https://arxiv.org/html/2608.18613#A8.SS2) 3. [H\.3Attribution to ATT&CK Techniques \(ATA\)](https://arxiv.org/html/2608.18613#A8.SS3) 4. [H\.4Attribution to CWE Weaknesses \(VCA\)](https://arxiv.org/html/2608.18613#A8.SS4) 5. [H\.5Multi\-Document Synthesis \(CSC, TAP, MLA\)](https://arxiv.org/html/2608.18613#A8.SS5)

## Appendix AThe Build Pipeline in Detail

§[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)states the rule the build follows and the invariants it guarantees\. This appendix gives the pipeline itself\. It runs once over the 321 vendor reports with a fixed build model \(gpt\-5\.4\-mini\), and is then frozen, so every query\-time configuration in §[4](https://arxiv.org/html/2608.18613#S4)consumes byte\-identical artifacts\. The operator prompts are reproduced in Appendix[G](https://arxiv.org/html/2608.18613#A7)\.

Table 4:The scaffold at a glance: what the build materializes from the released corpus, and the invariants the validator enforces\. Every identifier is checked against the pinned snapshots at write time, so zero fabrication holds by construction rather than by post\-hoc filtering\.Ontology nodesTyped edgesReport layer, cost, validationCVE3,011has\_weakness3,290Vendor reports321CWE1,342exploits\_weakness1,214Span\-grounded chunks688CAPEC615in\_tactic1,076Canonical entities4,868ATT&CK1,076child\_of533Build tokens \(one\-time\)1\.42Msub\_technique\_of518Build cost \(one\-time\)$1\.86maps\_to\_technique272Fabricated identifiers0CAPEC ordering194Orphan edges0Total6,044Total7,097Span violations0### A\.1Report Layer: the Four Stages

Step 0: semantic chunking\.Reports are segmented at clause boundaries and packed into chunks of 200–900 characters, never splitting mid\-clause; the corpus yields 688 chunks\. Each chunk records exact character offsets into the frozen source text, making the chunk the unit of both content and provenance \(C2\)\. The granularity is chosen to be navigable in both directions: a single clause is too small to ground a synthesis answer and a whole report too coarse to pin a specific fact, while a few\-clause chunk resolves up to its document and down to its spans\.

Step 1: typed entity mentions\.Per chunk, an LLM extracts typed entity mentions plus within\-chunk coreference links, which feed cross\-vendor resolution downstream\. The type system is a deliberately small, STIX\-aligned set of eight types \(threat\_actor,malware,tool,technique,vulnerability,campaign,identity,indicator\), chosen for extraction precision: mutually distinct, clearly realized on the surface, retrieval\-relevant\. Identifier\-bearing mentions \(CVE ids, ATT&CK T\-ids, hashes, IPs\) are captured by*deterministic regex guards*rather than trusted to the LLM, the classes where fabrication is cheapest to prevent are prevented outright\.

Step 2: TTP grounding\.A single\-pass extractor maps each chunk’s behavioral statements to ATT&CK technique ids, scaffolded by the fourteen tactics, with explicit exclusion of defender\-side behavior and worked examples for canonically under\-extracted techniques\. Every emitted T\-id is validated against the ATT&CK snapshot\.

Step 3: entity resolution\.Canonical entities are formed by a union\-find over four equivalence signals, ordered so that deterministic evidence dominates: \(a\) equality of grounded external identifiers; \(b\) TTP groundings \(natural\-language technique surfaces that ground to the same T\-id\); \(c\) normalized surface\-form equality within a type; \(d\) within\-chunk coreference aliases from Step 1 \(Algorithm[1](https://arxiv.org/html/2608.18613#alg1)\)\. The output is 4,868 canonical entities, each carrying its vendor\-attributed alias set and grounded external id where one exists, plus a bidirectional chunk↔\\leftrightarrowentity index\. That index is the load\-bearing artifact of the layer: an entity’s chunks are reachable*with their full text*\(the index\-to\-content link\), and a chunk’s entities are its retrieval keys\. Merge discipline mirrors the guard philosophy above: only exact and span\-verified alias evidence enters the union, while weak “possibly\-same” verdicts are retained as soft links outside the transitive closure, the discipline that keeps distinct state actors from collapsing into mega\-clusters, and the source of the resolution margin measured in §[4\.2](https://arxiv.org/html/2608.18613#S4.SS2)\.

### A\.2Embedding Model and Indexes

Paraphrase matching is a commodity, so CTIFoundry delegates it to an off\-the\-shelf embedding model \(text\-embedding\-3\-large, disk\-cached\), serving a chunk\-level index over the report corpus and one index per knowledge base\.

### A\.3Deterministic\-First Entity Resolution

Algorithm[1](https://arxiv.org/html/2608.18613#alg1)gives the merge procedure summarized in §[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)\. Its discipline is the invariant on the last line: only exact and span\-verified alias evidence enters the union, and weak “possibly\-same” verdicts are retained as soft links the agent can see but the build never merges on\. That is what rules out the transitive mega\-cluster failure mode quantified in §[4\.2](https://arxiv.org/html/2608.18613#S4.SS2)\.

Algorithm 1ResolveEntities: deterministic\-first union of mentions\.1:mentions

ℳ\\mathcal\{M\}\(typed, with grounded ids and coref links\); TTP groundings

𝒯\\mathcal\{T\}
2:canonical entities

ℰ\\mathcal\{E\}; entity

→\\tochunk index

Π\\Pi
3:

U←UnionFind​\(ℳ\)U\\leftarrow\\textsc\{UnionFind\}\(\\mathcal\{M\}\)
4:formentions

a,b∈ℳa,b\\in\\mathcal\{M\}of the same typedo

5:if

extid\(a\)=extid\(b\)≠⊥\\mathrm\{extid\}\(a\)=\\mathrm\{extid\}\(b\)\\neq\\botthen⊳\\triangleright\(a\) external\-id equality

6:

U\.union​\(a,b\)U\.\\textsc\{union\}\(a,b\)
7:elseif

𝒯\(a\)=𝒯\(b\)≠⊥\\mathcal\{T\}\(a\)=\\mathcal\{T\}\(b\)\\neq\\botthen⊳\\triangleright\(b\) same grounded T\-id

8:

U\.union​\(a,b\)U\.\\textsc\{union\}\(a,b\)
9:elseif

norm​\(a\)=norm​\(b\)\\textsc\{norm\}\(a\)=\\textsc\{norm\}\(b\)then⊳\\triangleright\(c\) normalized surface form

10:

U\.union​\(a,b\)U\.\\textsc\{union\}\(a,b\)
11:endif

12:endfor

13:forcoref link

\(a,b\)∈ℳ\(a,b\)\\in\\mathcal\{M\}do⊳\\triangleright\(d\) within\-chunk coreference

14:

U\.union​\(a,b\)U\.\\textsc\{union\}\(a,b\)
15:endfor

16:

ℰ←∅;Π←∅\\mathcal\{E\}\\leftarrow\\varnothing;\\ \\ \\Pi\\leftarrow\\varnothing
17:forcluster

c∈U\.sets​\(\)c\\in U\.\\textsc\{sets\}\(\)do

18:

ε←⟨aliases​\(c\),vendors​\(c\),g=groundedId​\(c\)⟩\\varepsilon\\leftarrow\\langle\\text\{aliases\}\(c\),\\,\\text\{vendors\}\(c\),\\,g\{=\}\\textsc\{groundedId\}\(c\)\\rangle
19:

ℰ←ℰ∪\{ε\};Π⁡\[ε\]←\{chunk⁡\(m\):m∈c\}\\mathcal\{E\}\\leftarrow\\mathcal\{E\}\\cup\\\{\\varepsilon\\\};\\ \\ \\Pi\[\\varepsilon\]\\leftarrow\\\{\\,\\mathrm\{chunk\}\(m\):m\\in c\\,\\\}
20:endfor

21:invariant:only exact/span\-verified evidence enters

UU; weak “possibly\-same” verdicts are kept as soft links, never unioned

22:return

ℰ,Π\\mathcal\{E\},\\Pi

## Appendix BThe CTI Ecosystem

§[2](https://arxiv.org/html/2608.18613#S2)compresses this to a paragraph\. The two source types in full:

Authoritative knowledge bases\.Four community\-maintained taxonomies form the reference backbone of the field: CVE \(specific vulnerability instances\), CWE \(weakness classes\), CAPEC \(attack patterns\), and MITRE ATT&CK \(adversary techniques, organized under fourteen tactics\)\([Strom et al\. 2018](https://arxiv.org/html/2608.18613#bib.bib48)\)\. Crucially, these are not four independent lists: the bases*officially cross\-reference*one another\. A CVE record names the CWE weakness it instantiates; a CAPEC pattern lists the CWE weaknesses it exploits and the ATT&CK techniques it maps to; techniques nest under parent techniques and tactics\. These cross\-references are curated by the taxonomy maintainers and are, for a large class of analyst questions,*the*authoritative answer: “which weakness underlies this vulnerability” is not a matter of textual similarity but a recorded edge\.

Vendor threat reports\.The narrative layer is written by security vendors: incident write\-ups, actor profiles, malware analyses\. Reports are prose, and their central entities \(threat actors, malware families, campaigns\) carry*vendor\-specific naming*: each vendor maintains its own nomenclature, and the same actor routinely has three or more names across the reporting landscape\. Intelligence about one campaign is therefore sharded across reports that do not share surface vocabulary\.

## Appendix CCTIConnect’s Measured Failure Diagnostics

§[2](https://arxiv.org/html/2608.18613#S2)summarizes the benchmark’s published diagnostics in three sentences and derives C1–C4 from them\. This appendix reproduces the account in full, since C1–C4 are motivated by these measurements rather than by argument\.

CTIConnect\([Cheng et al\. 2026b](https://arxiv.org/html/2608.18613#bib.bib12)\)operationalizes the workflow of §[2](https://arxiv.org/html/2608.18613#S2)as a public benchmark, and is to date the only CTI benchmark that evaluates LLMs with retrieval access to the domain’s knowledge sources rather than closed\-book: 1,859 expert\-verified questions over a released corpus of the four knowledge bases \(3,011 CVE, 1,342 CWE, 615 CAPEC, 1,076 ATT&CK entries\) plus 321 multi\-vendor report summaries, organized into nine tasks in three families\.*Entity linking*\(EL: RCM, WIM, ATD, ESD\) maps a behavioral description across taxonomies;*entity attribution*\(EA: ATA, VCA\) grounds report narratives to the sets of ATT&CK techniques or CWE weaknesses they describe;*multi\-document synthesis*\(MDS: CSC, TAP, MLA\) assembles campaign summaries, actor profiles, and malware lineages across report clusters\. EL and EA are scored by identifier\-normalized F1, MDS by a claim\-level LLM judge\. The benchmark’s evaluation, however, is confined to the*RAG setting*, fixed retrieve\-then\-generate pipelines over chunk\-and\-embed indexes, whereas the progress surveyed in §[1](https://arxiv.org/html/2608.18613#S1)has since made the*agentic*setting, multi\-step tool\-mediated investigation at query time, the operationally dominant way LLMs consume CTI in industry; the benchmark authors themselves name agentic design over the corpus as the open direction\.

What the benchmark’s published diagnostics\([Cheng et al\. 2026b](https://arxiv.org/html/2608.18613#bib.bib12)\)do establish, and what this paper builds on, is a*measured*account of where LLM\-over\-CTI fails\. They quantify a cross\-source semantic gap, the difference between a query’s embedding similarity to its gold evidence and to its top\-retrieved candidate, that widens systematically with the heterogeneity a task must bridge \(0\.06 within taxonomy vocabulary, 0\.31 from narrative to taxonomy terminology, 0\.43 across alias\-sharded vendor reports\), sinking gold evidence from mean rank 4\.2 to 6\.5 to 9\.2, the latter two beyond the typical top\-kkwindow\. They isolate the mechanisms:*aliasing*\(reports naming one actor under different vendor names share no surface vocabulary, so near\-miss distractors outscore the gold cluster;*register mismatch*\) reports describe behavior in action\-oriented prose while taxonomies encode it in technique\-oriented terminology, so embeddings miss links that an official cross\-reference already records; and*sibling confusion*, among lexically adjacent taxonomy entries, retrieval surfaces candidates the model then fails to discriminate, and in attribution every incorrectly retrieved entry becomes a wrong answer element outright, at times dragging retrieval\-augmented accuracy*below*the closed\-book baseline\. They further establish that these failures are structural rather than incidental: general\-purpose retrieval upgrades \(retrieve\-then\-rerank, iterative retrieval\) recover only a small fraction of the gap that interventions on vocabulary and entity structure recover\. These documented gaps, joined by two demands operational CTI adds on top of any benchmark, namely that every claim be auditable back to the vendor and sentence that asserted it, and that the analyst’s procedural discipline \(resolve names before searching, trust a recorded edge over textual similarity, verify every candidate\) is written down nowhere in the corpus, translate into four challenges that an agent\-facing substrate must meet, each answered by one CTIFoundry component:

## Appendix DThe Seven Typed Tools

§[3\.3](https://arxiv.org/html/2608.18613#S3.SS3)states the three rules the action surface is designed under, non\-overlap, self\-description, and structure before similarity\. Table[5](https://arxiv.org/html/2608.18613#A4.T5)is the surface itself: each tool’s capability and the cost class shipped to the agent in its description\. The exact tool descriptions the agent sees are reproduced in Appendix[G\.1](https://arxiv.org/html/2608.18613#A7.SS1)\.

Table 5:The seven typed tools of the CTIFoundry action surface, each exposing one non\-overlapping scaffold capability with its usage guidance and cost shipped to the agent\.ToolCapabilityCostresolve\_entityname/alias/id→\\tocanonical entities with cross\-vendor alias lists and grounded external ids; prescribed first callcheapget\_entityfull record of one ontology node or report entitycheapontology\_neighborstraverse official cross\-reference edges \(has\_weakness,exploits\_weakness,maps\_to\_technique, …\); deterministiccheapsearch\_kbhybrid dense\+BM25 search over one KB, withmust\_termsconjunctive filter and pool\-size feedbackmoderatesearch\_chunksdense search over report chunks; returns text with the entities/TTPs that index it \(pivot into the graph\)moderatechunks\_mentioningall chunks of every report where an entity appears, with full text, the cross\-vendor collection primitivecheapread\_reportfull text of one report by document idcheap
## Appendix EAdditional Experimental Results

### E\.1RQ1: Extraction Quality Across Operator Models

Extraction quality across operators\.Table[1](https://arxiv.org/html/2608.18613#S4.T1)varies the extraction operator over six models under two metrics: typed\-mention extraction against a stratified human\-audited gold set \(∼\\sim60 chunks, all eight types; a type error is both a miss and a false positive\), and TTP grounding on groundable gold \(chunks stating a behavior with an explicit T\-id, stripped before extraction\) augmented by∼\\sim40 vague or defender\-side phrases whose correct output is abstention\. Flagships reach F1 0\.859 / 0\.792 \(entity / TTP\), and small operators trail by 10–20 points: but*almost entirely in recall*: they under\-extract rather than invent, the one degradation mode a build pipeline can absorb, since a missing mention costs coverage while a fabricated one would breach the invariant the whole scaffold rests on\.

### E\.2Scalability at1\.7×1\.7\\timesthe Question Volume

Dropped from the main text for length; §[4\.4](https://arxiv.org/html/2608.18613#S4.SS4)states the result in one sentence\. The controlled comparison is established on the main set, so at scale we measure CTIFoundry only, asking whether accuracy or cost degrades at1\.7×1\.7\\timesthe question volume\.

### E\.3RQ4: Scalability

At1\.7×1\.7\\timesthe question volume neither property degrades \(Table[6](https://arxiv.org/html/2608.18613#A5.T6)and Figure[2\(a\)](https://arxiv.org/html/2608.18613#S4.F2.sf1); discussion in Appendix[E\.2](https://arxiv.org/html/2608.18613#A5.SS2)\)\. Cost stays linear, the same≈\\approx2\.6 cents and≈\\approx7 seconds per investigation as on the main set, as a build\-once substrate should be\. Accuracy holds: forward EL persists at the main\-set ceiling \(RCM 0\.988, ATD 0\.957, ESD 0\.834\), reverse linking holds once the playbook routes it through the authoritative edge \(WIM 0\.702 vs\. 0\.723\), and synthesis is the*strongest*family at scale \(CSC 0\.917, TAP 0\.826, MLA 0\.848\), volume stresses retrieval recall, which is exactly what the entity index supplies\. Attribution is drawn harder at scale and still lands at or above what the flat substrate reached on the main set’s easier attribution questions\.

Table 6:CTIFoundry accuracy on the scale set \(gpt\-5\.4\); the base arm is not re\-run at scale\.FamilyTasknnCTIFoundry F1ELRCM1900\.988WIM2080\.702ATD1610\.957ESD1800\.834EAATA1000\.586VCA1290\.500MDSCSC600\.917TAP800\.826MLA600\.848
### E\.4A Qualitative Case Study

Dropped from the main text for length; §[4\.4](https://arxiv.org/html/2608.18613#S4.SS4)states the two findings it contributes\. Figure[2\(b\)](https://arxiv.org/html/2608.18613#S4.F2.sf2)in the main text aggregates the tool\-call profile this trace exemplifies\.

### E\.5RQ6: A Qualitative Case Study

Figure[2\(b\)](https://arxiv.org/html/2608.18613#S4.F2.sf2)gives the per\-tool call profile, and Appendix[E\.4](https://arxiv.org/html/2608.18613#A5.SS4)traces one item,rcm\-005, on both arms \(Figure[4](https://arxiv.org/html/2608.18613#A5.F4)\)\. Two findings carry into the argument\. First, the base agent does not fail to*find*the source CVE, its very firstgrepsurfaces it, it fails because the flat substrate offers no operation for*using*it, and the wrong answer it commits to lies on a real authoritative edge from a different source entity\. Semantic similarity to the target therefore carries no information about which official edge a question was generated from, which is what the skill’s first rule encodes\. Second, the aggregate profile shows the design’s intended plans are the plans the agent actually runs: forward EL is a tightsearch\_kb→\\toontology\_neighbors→\\toget\_entityspine at compliance1\.001\.00, while MDS leans onread\_reportand the entity index and*never touches the ontology tools*, the agent uses structure where it exists and ignores it where it does not, unprompted by any router\.

![Refer to caption](https://arxiv.org/html/2608.18613v1/f_case.png)Figure 4:Both arms on entity\-linking itemrcm\-005\(gpt\-5\.4\)\. Four calls and≈\\approx8 seconds on either arm: the gap is direction, not effort\.

## Appendix FExtended Related Work

§[5](https://arxiv.org/html/2608.18613#S5)states this paper’s position against each neighboring line in compressed form\. This appendix gives the same five comparisons at length, with the positioning arguments spelled out\.

### F\.1CTI Knowledge Extraction and Representation

Turning threat reports into structure has evolved through three generations\. The first targeted*indicators of compromise*: systems such as iACE\([Liao et al\. 2016](https://arxiv.org/html/2608.18613#bib.bib28)\)mined IPs, hashes, and domains from open\-source reporting, shallow artifacts with no behavioral semantics\. The second generation lifted extraction to*behavior*: TTPDrill\([Husari et al\. 2017](https://arxiv.org/html/2608.18613#bib.bib20)\)mapped report sentences to attack techniques, ChainSmith\([Zhu & Dumitras 2018](https://arxiv.org/html/2608.18613#bib.bib61)\)learned campaign\-stage semantics, EXTRACTOR\([Satvat et al\. 2021](https://arxiv.org/html/2608.18613#bib.bib42)\)distilled attack behavior graphs from prose, AttacKG\([Li et al\. 2022](https://arxiv.org/html/2608.18613#bib.bib27)\)assembled technique\-level attack graphs, and LADDER\([Alam et al\. 2023](https://arxiv.org/html/2608.18613#bib.bib1)\)extracted attack patterns beyond IoCs, each a bespoke NLP pipeline with its own schema, and each brittle in the way supervised pipelines over adversarial prose tend to be\. The third generation replaced the pipelines with LLMs: CTINexus\([Cheng et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib10)\)showed that optimized in\-context learning constructs CTI knowledge graphs with minimal supervision, largely closing the extraction\-quality question\.

This line treats extraction as the endpoint: the product is a graph for human inspection or a downstream classifier\. What it leaves open is the question this paper starts from:*what shape must extracted structure take to be consumed by an investigating agent?*Our answer is deliberately subtractive: the CTIFoundry report layer extracts typed entities and groundings but no relational triples \(§[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)\), because its consumer reads provenance text rather than reasoning over extracted edges\. CTIFoundry is thus complementary to this line: it takes extraction\-quality as a solved input \(RQ1 quantifies the residual model\-dependence\), and contributes the consumption\-side design\.

A parallel representational line connects the authoritative taxonomies themselves \(CVE, CWE, CAPEC, ATT&CK\([Strom et al\. 2018](https://arxiv.org/html/2608.18613#bib.bib48)\), exchanged under standards such as STIX\([OASIS 2021](https://arxiv.org/html/2608.18613#bib.bib33)\)\) into unified graphs, with BRON\([Hemberg et al\. 2021](https://arxiv.org/html/2608.18613#bib.bib19)\)linking tactics through vulnerabilities into one bidirectional graph for offline threat hunting, and follow\-on work densifying its mappings\. These graphs are*static analytic assets*: consumed by human queries outside any retrieval or generation loop, with no integrity guarantee on what enters them\. CTIFoundry’s ontology layer is materially the same data, the contribution is its*operationalization*as an agent action surface: a deterministic rebuild from pinned snapshots under a zero\-fabrication invariant \(§[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)\), a traversal tool whose self\-description teaches the agent to prefer recorded edges over text similarity, and the canonical\-entity bridge into the report layer that the static\-graph line does not provide\.

### F\.2From Retrieval Pipelines to Agentic Search

Classic RAG retrieves top\-kkchunks by embedding similarity and generates once\([Lewis et al\. 2020](https://arxiv.org/html/2608.18613#bib.bib24)\); its failures on structure\-heavy corpora drew two pipeline\-side responses: interposing derived structure between corpus and query \(GraphRAG\([Edge et al\. 2024](https://arxiv.org/html/2608.18613#bib.bib16)\), LightRAG\([Guo et al\. 2024](https://arxiv.org/html/2608.18613#bib.bib17)\), RAPTOR\([Sarthi et al\. 2024](https://arxiv.org/html/2608.18613#bib.bib41)\), HippoRAG\([Gutiérrez et al\. 2024](https://arxiv.org/html/2608.18613#bib.bib18)\)\), and fusing lexical with dense evidence\([Robertson & Zaragoza 2009](https://arxiv.org/html/2608.18613#bib.bib39);[Cormack et al\. 2009](https://arxiv.org/html/2608.18613#bib.bib15)\), which CTIFoundry adopts for its KB surface \(§[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)\)\. The field has since moved the retrieval decision itself into an LLM loop\([Singh et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib46)\), and the current frontier is*deep research*: agents that interleave reasoning with multi\-round search over an external environment, increasingly trained end\-to\-end with reinforcement learning, Search\-R1\([Jin et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib22)\)and R1\-Searcher\([Song et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib47)\)learn when and what to query, ZeroSearch\([Sun et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib49)\)trains the capability without a live engine, DeepResearcher\([Zheng et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib60)\)scales the loop to the open web, and WebThinker\([Li et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib26)\)couples search with report drafting; BrowseComp\-Plus\([Chen et al\. 2026b](https://arxiv.org/html/2608.18613#bib.bib9)\)pins such agents to a fixed corpus so that retrieval choices become comparable, the same control our methodology imposes\. A neighboring line has agents traverse*existing*knowledge graphs at query time \(StructGPT\([Jiang et al\. 2023](https://arxiv.org/html/2608.18613#bib.bib21)\), Think\-on\-Graph\([Sun et al\. 2024](https://arxiv.org/html/2608.18613#bib.bib50)\)\), assuming a curated open\-domain graph as given\.

As attention has concentrated on agentic search, the capability being built has begun to turn on its own components: the same reason–act competence that lets an agent plan a multi\-round investigation also lets it inspect, diagnose, and rewrite the machinery conducting that investigation\. This is the*self\-evolving agent*, a frozen model that improves by editing the scaffolding around itself, up to and including authoring new tools for its own use\. Meta\-Harness searches over harness code with an agentic proposer reading prior traces off a filesystem\([Lee et al\. 2026](https://arxiv.org/html/2608.18613#bib.bib23)\); Self\-Harness closes a mine–propose–validate loop on model\-specific failure patterns\([Zhang et al\. 2026](https://arxiv.org/html/2608.18613#bib.bib58)\); AutoHarness has the model synthesize its harness as code against environment feedback\([Lou et al\. 2026](https://arxiv.org/html/2608.18613#bib.bib32)\); and follow\-on work asks which capability the loop actually requires\([Lin et al\. 2026](https://arxiv.org/html/2608.18613#bib.bib29);[Chen et al\. 2026a](https://arxiv.org/html/2608.18613#bib.bib8)\)\. The searcher thus optimizes itself: but what it searches remains outside the loop\. The editable surface throughout is the harness \(prompts, skills, memory, control logic, and the tools’ code\), while the substrate underneath is still whatever the corpus was packaged as: a generic search API, a single retrieve tool, or an already\-built graph\. A tool the agent writes for itself can only compose operations the substrate already affords; it cannot author an edge the corpus never materialized\. CTIFoundry therefore moves one layer down and holds the harness fixed \(a stock loop, no training, no evolution\), rebuilding instead what the harness acts*on*: typed traversal over validated official edges, alias resolution, hybrid search with an explicit iteration signal, and entity\-indexed collection\. On this corpus the resulting seven\-tool surface is self\-sufficient \(§[4\.3](https://arxiv.org/html/2608.18613#S4.SS3)\); letting the scaffold and its action surface evolve themselves is a natural extension we leave to future work\.

### F\.3LLM\-Augmented Data Management and Knowledge\-Base Construction

The database community’s own answer to unstructured corpora is to move LLM operators inside the data processing loop\. Semantic operators supply the declarative formalism, with per\-operator optimization under accuracy guarantees in LOTUS\([Patel et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib35)\); Palimpzest\([Liu et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib31)\)and Abacus\([Russo et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib40)\)cast plan selection as cost–quality optimization; DocETL\([Shankar et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib44)\)rewrites and validates document pipelines agentically; ZenDB\([Lin et al\. 2024](https://arxiv.org/html/2608.18613#bib.bib30)\)builds semantic indexes for document analytics; and LLM agents for data\-management tasks are emerging as an architecture of their own\([Li et al\. 2024](https://arxiv.org/html/2608.18613#bib.bib25)\)\. The discipline these systems inherit is older, and is the one CTIFoundry’s build inherits directly: knowledge\-base construction from dark data, where DeepDive\([Zhang et al\. 2017](https://arxiv.org/html/2608.18613#bib.bib57)\)and Fonduer\([Wu et al\. 2018](https://arxiv.org/html/2608.18613#bib.bib53)\)established that reliability comes from declarative structure, provenance, and validation rather than from any single extractor, with entity resolution as its classical core\([Christophides et al\. 2020](https://arxiv.org/html/2608.18613#bib.bib14)\)\. Running through both generations is one requirement: a text\-to\-structure operator is trustworthy only when its output is checkable against a grammar or schema rather than accepted on the model’s word\. NL2Logic\([Putra et al\. 2026](https://arxiv.org/html/2608.18613#bib.bib36)\)makes this explicit in the translation setting, using the target formalism’s abstract syntax tree to steer an LLM into first\-order logic that is well\-formed by construction\.

CTIFoundry is this discipline pointed at a new consumer\. Semantic\-operator systems execute per query, re\-optimizing each user pipeline for cost and accuracy; CTIFoundry runs once, offline, and its product is not a query answer but a substrate: span\-grounded provenance on every assertion, deterministic guards wherever determinism is available \(identifier regexes, snapshot validation\), deterministic\-first entity resolution \(Alg\.[1](https://arxiv.org/html/2608.18613#alg1)\), and a blocking validator enforcing the zero\-fabrication invariant \(§[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)\)\. The consumer shift is what changes the design: classical KBC targets a schema a human analyst or downstream classifier will query, so its output is optimized for relational completeness, whereas CTIFoundry’s output schema is dictated by what an autonomous investigator can traverse and verify, which is why the report layer extracts typed entities and groundings but deliberately no relational triples \(§[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)\)\. The nearest LLM\-era stores structure*conversational memory*\(MemGPT’s paged context\([Packer et al\. 2023](https://arxiv.org/html/2608.18613#bib.bib34)\), Zep’s temporal knowledge graph\([Rasmussen et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib38)\), Mem0’s long\-term store\([Chhikara et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib13)\)\) whereas CTIFoundry structures a*domain corpus*anchored to external authoritative taxonomies, where fabrication is definable and measurable\.

### F\.4Agent Interfaces, Skills, and Context Engineering

The reason–act loop\([Yao et al\. 2023](https://arxiv.org/html/2608.18613#bib.bib56)\)and learned tool invocation\([Schick et al\. 2023](https://arxiv.org/html/2608.18613#bib.bib43)\)have hardened into engineering practice: MCP standardizes tool protocols\([Anthropic 2024](https://arxiv.org/html/2608.18613#bib.bib3)\), and tool and context design now carry their own guidance literature\([Anthropic 2025d](https://arxiv.org/html/2608.18613#bib.bib7);[Anthropic 2025a](https://arxiv.org/html/2608.18613#bib.bib4)\)\. The result our methodology leans on is SWE\-agent’s: a purpose\-built*agent–computer interface*over a code repository outperforms a raw shell at fixed model\([Yang et al\. 2024](https://arxiv.org/html/2608.18613#bib.bib55)\), and its minimal successor mini\-swe\-agent\([Yang & mini\-swe\-agent contributors 2025](https://arxiv.org/html/2608.18613#bib.bib54)\)reduces the harness to the commodity our controlled design requires \(§[4\.1](https://arxiv.org/html/2608.18613#S4.SS1)\)\. On the procedural side, skills have become first\-class deployable artifacts: Agent Skills package procedural knowledge as files an agent loads on demand\([Anthropic 2025c](https://arxiv.org/html/2608.18613#bib.bib6)\), Agent Workflow Memory induces reusable workflows from an agent’s own trajectories\([Wang et al\. 2024](https://arxiv.org/html/2608.18613#bib.bib52)\), and agentic context engineering evolves the context itself as an updatable playbook\([Zhang et al\. 2025](https://arxiv.org/html/2608.18613#bib.bib59);[Cheng et al\. 2026a](https://arxiv.org/html/2608.18613#bib.bib11)\), maturing the direction opened by Voyager’s skill library\([Wang et al\. 2023](https://arxiv.org/html/2608.18613#bib.bib51)\)and Reflexion’s verbal feedback\([Shinn et al\. 2023](https://arxiv.org/html/2608.18613#bib.bib45)\)\.

Both threads take the environment as given: interface work targets the computer layer, and skill work is task\-generic or induced against whatever tools exist\. CTIFoundry binds both to a corpus\. The interface*is*a data substrate, built offline under validated invariants; the skills are corpus\-bound: their central prescriptions \(resolve, traverse an official edge, consult an alias set\) name actions that exist only because the build materialized them\. The2×22\{\\times\}2design of §[4\.5](https://arxiv.org/html/2608.18613#S4.SS5)turns this binding from a design intuition into a measured result: skills alone recover\+0\.062\+0\.062, tools alone\+0\.136\+0\.136, and together\+0\.219\+0\.219, procedural advice binds only to structure that exists, a corpus\-side controlled question the harness literature has not posed\. The same experiments contribute a deployment finding for skill engineering: identical skill text is under\-followed in the system prompt by smaller models yet followed reliably in the user turn\.

### F\.5CTI and Security Benchmarks on LLM

Evaluation of LLMs on CTI has progressed from representation quality \(CyBERT\([Ranade et al\. 2021](https://arxiv.org/html/2608.18613#bib.bib37)\)\) to knowledge\-and\-reasoning probes \(CTIBench\([Alam et al\. 2024](https://arxiv.org/html/2608.18613#bib.bib2)\)\), which test what a model knows without grounding it in a corpus\. CTIConnect\([Cheng et al\. 2026b](https://arxiv.org/html/2608.18613#bib.bib12)\)is the setting closest to ours and the one we adopt: corpus\-grounded, expert\-verified tasks spanning entity linking, attribution, and multi\-document synthesis, together with the measurement that chunk\-and\-embed RAG stalls exactly on the cross\-source tasks, and an explicit call for agentic harness design as future work\. We answer that call with a reframing: the binding side is not the harness but the corpus\. We use the benchmark’s tasks and released corpus unchanged, re\-measure every baseline under our own fixed harness \(no numbers are imported from prior work\), and show the bottleneck it measured is a substrate property that build\-time scaffolding removes\.

## Appendix GPrompt Templates

This appendix reproduces, verbatim, every prompt used by CTIFoundry: the two agent system prompts that constitute the paper’s sole experimental variable \(§[G\.1](https://arxiv.org/html/2608.18613#A7.SS1)\), the build\-time operator prompts that materialize the scaffold \(§[G\.2](https://arxiv.org/html/2608.18613#A7.SS2)–§[G\.5](https://arxiv.org/html/2608.18613#A7.SS5)\), and the judge prompt behind the MDS metric \(§[G\.6](https://arxiv.org/html/2608.18613#A7.SS6)\)\. The five procedural skill playbooks follow in Appendix[H](https://arxiv.org/html/2608.18613#A8)\. Placeholders in\{\}\(Pythonstr\.format\) and\{\{ \}\}\(Jinja2\) are substituted at runtime\. Throughout,system promptsare shown in blue,user promptsin green, andskill playbooksin rose\.

### G\.1Agent System Prompts: the Two Arms

These two prompts are the experiment of §[4\.3](https://arxiv.org/html/2608.18613#S4.SS3)\. Both arms run the same harness, model, step budget, and temperature; the only difference between them is which of the following is installed as the system prompt and which action surface it describes, the seven typed tools of Table[5](https://arxiv.org/html/2608.18613#A4.T5)for CTIFoundry, a singlebashtool over the corpus dumped to flat files for the base arm\. Each prompt is deliberately short: the substrate, not the prompt, is what the paper varies\.

System Prompt: CTIFoundry Arm \(typed tools\)[⬇](data:text/plain;base64,WW91IGFyZSBhIENUSSBhbmFseXN0LiBJbnZlc3RpZ2F0ZSB0aGUgcXVlc3Rpb24gdXNpbmcgdGhlIGF2YWlsYWJsZSB0b29scywgb25lIG9yIG1vcmUgdG9vbCBjYWxscyBwZXIgdHVybiwgdGhlbiBjYWxsIHN1Ym1pdF9hbnN3ZXIgd2l0aCB0aGUgZmluYWwgYW5zd2VyLiBSZXNvbHZlIG5hbWVzIHRvIGNhbm9uaWNhbCBlbnRpdGllcyBmaXJzdDsgcHJlZmVyIGF1dGhvcml0YXRpdmUgc3RydWN0dXJlIG92ZXIgaW5mZXJlbmNlOyBzdGF0ZSBleGFjdCBpZGVudGlmaWVycyAoQ1ZFLS9DV0UtL0NBUEVDLS9ULWlkcywgY2Fub25pY2FsIG5hbWVzKSBleHBsaWNpdGx5Lg==)YouareaCTIanalyst\.Investigatethequestionusingtheavailabletools,oneormoretoolcallsperturn,thencallsubmit\_answerwiththefinalanswer\.Resolvenamestocanonicalentitiesfirst;preferauthoritativestructureoverinference;stateexactidentifiers\(CVE\-/CWE\-/CAPEC\-/T\-ids,canonicalnames\)explicitly\.

System Prompt: Base Arm \(bash over flat files\)[⬇](data:text/plain;base64,WW91IGFyZSBhIENUSSBhbmFseXN0IHdpdGggYSBiYXNoIHNoZWxsLiBUaGUgY3VycmVudCBkaXJlY3RvcnkgaG9sZHMgYSBmbGF0IENUSSBjb3JwdXM6IHJlcG9ydHMvPGRvY19pZD4udHh0ICgzMjEgdmVuZG9yIHRocmVhdCByZXBvcnRzKSBhbmQga2Ive2N2ZSxjd2UsY2FwZWMsdGVjaG5pcXVlLHRhY3RpY30uanNvbmwgKG9uZSBKU09OIGVudHJ5IHBlciBsaW5lKS4gSW52ZXN0aWdhdGUgd2l0aCBvbmUgYmFzaCBjb21tYW5kIHBlciB0dXJuIChncmVwL2NhdC9hd2s7IGVhY2ggY29tbWFuZCBydW5zIGluIGEgZnJlc2ggc2hlbGwsIHNvIGNoYWluIHdpdGggcGlwZXMpLiBTdGF0ZSBleGFjdCBpZGVudGlmaWVycyAoQ1ZFLS9DV0UtL0NBUEVDLS9ULWlkcywgY2Fub25pY2FsIG5hbWVzKSBleHBsaWNpdGx5LiBXaGVuIHlvdSBoYXZlIHRoZSBhbnN3ZXIsIHJ1biBhIHNpbmdsZSBjb21tYW5kIHdob3NlIEZJUlNUIG91dHB1dCBsaW5lIGlzIGV4YWN0bHkgQ09NUExFVEVfVEFTS19BTkRfU1VCTUlUX0ZJTkFMX09VVFBVVCBmb2xsb3dlZCBieSB5b3VyIGFuc3dlciB0ZXh0LCBlLmcuCiAgZWNobyBDT01QTEVURV9UQVNLX0FORF9TVUJNSVRfRklOQUxfT1VUUFVUOyBlY2hvICdUaGUgd2Vha25lc3MgaXMgQ1dFLTM4NC4n)YouareaCTIanalystwithabashshell\.ThecurrentdirectoryholdsaflatCTIcorpus:reports/<doc\_id\>\.txt\(321vendorthreatreports\)andkb/\{cve,cwe,capec,technique,tactic\}\.jsonl\(oneJSONentryperline\)\.Investigatewithonebashcommandperturn\(grep/cat/awk;eachcommandrunsinafreshshell,sochainwithpipes\)\.Stateexactidentifiers\(CVE\-/CWE\-/CAPEC\-/T\-ids,canonicalnames\)explicitly\.Whenyouhavetheanswer,runasinglecommandwhoseFIRSToutputlineisexactlyCOMPLETE\_TASK\_AND\_SUBMIT\_FINAL\_OUTPUTfollowedbyyouranswertext,e\.g\.echoCOMPLETE\_TASK\_AND\_SUBMIT\_FINAL\_OUTPUT;echo’TheweaknessisCWE\-384\.’

The user turn is identically templated in both arms; the per\-task skill of Appendix[H](https://arxiv.org/html/2608.18613#A8)is prepended to it for the CTIFoundry arm, and the answer\-format template for the MDS tasks is appended in both arms so that the two arms are scored on the same output shape\.

User Turn Template: Both Arms[⬇](data:text/plain;base64,IyMgUXVlc3Rpb24Ke3t0YXNrfX0=)\#\#Question\{\{task\}\}

### G\.2Build Time: Span\-Grounded Extraction

The report layer’s extraction operator \(§[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)\)\. The report is presented as numbered spans and every emitted surface must be a verbatim substring of the span it is attributed to, which is what makes the character\-offset provenance of C2 checkable rather than merely asserted: the build validator re\-locates each surface in its span and drops what it cannot find\.

System Prompt: Span\-Grounded Extraction[⬇](data:text/plain;base64,WW91IGFyZSBhIHByZWNpc2UgQ1RJIGluZm9ybWF0aW9uLWV4dHJhY3Rpb24gZW5naW5lLiBPdXRwdXQgb25seSBKU09OLg==)YouareapreciseCTIinformation\-extractionengine\.OutputonlyJSON\.

User Prompt: Span\-Grounded Extraction[⬇](data:text/plain;base64,RXh0cmFjdCBhIHNwYW4tZ3JvdW5kZWQga25vd2xlZGdlIGdyYXBoIGZyb20gdGhpcyBjeWJlciB0aHJlYXQgaW50ZWxsaWdlbmNlIHJlcG9ydC4KClRoZSByZXBvcnQgaXMgc2VnbWVudGVkIGludG8gbnVtYmVyZWQgc3BhbnM6CntzcGFuc19ibG9ja30KCkVtaXQgYSBKU09OIG9iamVjdDoKe3sKICAibWVudGlvbnMiOiBbCiAgICB7eyJpZCI6ICJtMSIsICJlbnRpdHlfdHlwZSI6ICI8b25lIG9mIHtldHlwZXN9PiIsCiAgICAgICJzdXJmYWNlIjogIjx2ZXJiYXRpbSBzdWJzdHJpbmcgb2YgdGhlIHNwYW4+IiwgInNlbnRfaWR4IjogPHNwYW4gbnVtYmVyPn19CiAgXSwKICAidHJpcGxlcyI6IFsKICAgIHt7InNyYyI6ICJtMSIsICJyZWwiOiAiPG9uZSBvZiB7cmVsc30+IiwgImRzdCI6ICJtMiIsICJzZW50X2lkeCI6IDxzcGFuIG51bWJlciB3aGVyZSB0aGlzIHJlbGF0aW9uIGlzIGFzc2VydGVkPn19CiAgXQp9fQoKUnVsZXM6Ci0gInN1cmZhY2UiIE1VU1QgYmUgY29waWVkIHZlcmJhdGltIChjYXNlIGluY2x1ZGVkKSBmcm9tIHRoZSBzcGFuIG51bWJlcmVkIHNlbnRfaWR4LgotIENPTVBMRVRFTkVTUyBNQVRURVJTOiBleHRyYWN0IEVWRVJZIG5hbWVkIHRocmVhdCBhY3RvciwgbWFsd2FyZSBmYW1pbHksIGF0dGFjayB0b29sLCB0ZWNobmlxdWUsIHZ1bG5lcmFiaWxpdHksIGNhbXBhaWduLCBpbmRpY2F0b3IgKGhhc2gvSVAvZG9tYWluKSwgdGFyZ2V0ZWQgc2VjdG9yL3JlZ2lvbi9vcmdhbml6YXRpb24g4oCUIGluY2x1ZGluZyBvbmVzIG1lbnRpb25lZCBpbiBwYXNzaW5nIChlLmcuICJyZWNydWl0ZWQgYWZmaWxpYXRlcyBmcm9tIEJsYWNrTWF0dGVyLCBSRXZpbCBhbmQgRGFya1NpZGUiIG5hbWVzIHRocmVlIHRocmVhdCBhY3RvcnMpLgotIEEgdHJpcGxlJ3MgcmVsYXRpb24gbXVzdCBiZSBleHBsaWNpdGx5IGFzc2VydGVkIGluIGl0cyBzcGFuLCBub3QgaW5mZXJyZWQgZnJvbSBjby1vY2N1cnJlbmNlLgotICJhbGlhc19vZiIgdHJpcGxlcyBjYXB0dXJlIEVWRVJZIG5hbWluZyBzdGF0ZW1lbnQ6ICJYIChhbHNvIGtub3duIGFzIFkpIiwgIlgsIHRyYWNrZWQgYXMgWSIsICJYIGFrYSBZIiwgInRoZSBYIGdyb3VwIG9wZXJhdGVzIHRoZSBZIHJhbnNvbXdhcmUiIGRvZXMgTk9UIG1ha2UgWCBhbiBhbGlhcyBvZiBZLCBidXQgIlkgKGZvcm1lcmx5IFgpIiBkb2VzLiBOZXZlciBtaXNzIGFuIGFsaWFzIHN0YXRlbWVudCDigJQgY3Jvc3MtdmVuZG9yIG5hbWluZyBpcyBjcml0aWNhbCBkb3duc3RyZWFtLgotIEVudGl0aWVzLCBub3QgZGVzY3JpcHRpb25zOiBzdXJmYWNlcyBzaG91bGQgYmUgcHJvcGVyIG5hbWVzIG9yIGlkZW50aWZpZXJzLCBub3QgZ2VuZXJpYyBwaHJhc2VzICgidGhlIG1hbHdhcmUiLCAiYSBwaGlzaGluZyBjYW1wYWlnbiIgYXJlIE5PVCBtZW50aW9uczsgcmFuc29tIGFtb3VudHMgYXJlIE5PVCBpbmRpY2F0b3JzKS4KLSBQcmVmZXIgc3BlY2lmaWMgcmVsYXRpb25zOyBlbWl0IG5vdGhpbmcgeW91IGNhbm5vdCBhbmNob3IgdG8gYSBzcGFuLgoKV29ya2VkIGV4YW1wbGUuIFNwYW4gIlsyXSBEYXJrR2F0ZSAoYWxzbyBrbm93biBhcyBNZWhDcnlwdGVyKSwgb3BlcmF0ZWQgYnkgdGhlIFJhc3RhZmFyZXllIHBlcnNvbmEsIGV4cGxvaXRlZCBDVkUtMjAyNC0yMTQxMiB0byB0YXJnZXQgZmluYW5jaWFsIG9yZ2FuaXphdGlvbnMgaW4gRXVyb3BlIiB5aWVsZHMgbWVudGlvbnMgbTE9RGFya0dhdGUvbWFsd2FyZSwgbTI9TWVoQ3J5cHRlci9tYWx3YXJlLCBtMz1SYXN0YWZhcmV5ZS90aHJlYXRfYWN0b3IsIG00PUNWRS0yMDI0LTIxNDEyL3Z1bG5lcmFiaWxpdHksIG01PWZpbmFuY2lhbC9zZWN0b3IsIG02PUV1cm9wZS9yZWdpb24gYW5kIHRyaXBsZXMgKG0yIGFsaWFzX29mIG0xKSwgKG0zIG9wZXJhdGVzIG0xKSwgKG0xIGV4cGxvaXRzIG00KSwgKG0xIHRhcmdldHMgbTUpLCAobTEgdGFyZ2V0cyBtNiksIGFsbCB3aXRoIHNlbnRfaWR4PTIu)Extractaspan\-groundedknowledgegraphfromthiscyberthreatintelligencereport\.Thereportissegmentedintonumberedspans:\{spans\_block\}EmitaJSONobject:\{\{"mentions":\[\{\{"id":"m1","entity\_type":"<oneof\{etypes\}\>","surface":"<verbatimsubstringofthespan\>","sent\_idx":<spannumber\>\}\}\],"triples":\[\{\{"src":"m1","rel":"<oneof\{rels\}\>","dst":"m2","sent\_idx":<spannumberwherethisrelationisasserted\>\}\}\]\}\}Rules:\-"surface"MUSTbecopiedverbatim\(caseincluded\)fromthespannumberedsent\_idx\.\-COMPLETENESSMATTERS:extractEVERYnamedthreatactor,malwarefamily,attacktool,technique,vulnerability,campaign,indicator\(hash/IP/domain\),targetedsector/region/organization—includingonesmentionedinpassing\(e\.g\."recruitedaffiliatesfromBlackMatter,REvilandDarkSide"namesthreethreatactors\)\.\-Atriple’srelationmustbeexplicitlyassertedinitsspan,notinferredfromco\-occurrence\.\-"alias\_of"triplescaptureEVERYnamingstatement:"X\(alsoknownasY\)","X,trackedasY","XakaY","theXgroupoperatestheYransomware"doesNOTmakeXanaliasofY,but"Y\(formerlyX\)"does\.Nevermissanaliasstatement—cross\-vendornamingiscriticaldownstream\.\-Entities,notdescriptions:surfacesshouldbepropernamesoridentifiers,notgenericphrases\("themalware","aphishingcampaign"areNOTmentions;ransomamountsareNOTindicators\)\.\-Preferspecificrelations;emitnothingyoucannotanchortoaspan\.Workedexample\.Span"\[2\]DarkGate\(alsoknownasMehCrypter\),operatedbytheRastafareyepersona,exploitedCVE\-2024\-21412totargetfinancialorganizationsinEurope"yieldsmentionsm1=DarkGate/malware,m2=MehCrypter/malware,m3=Rastafareye/threat\_actor,m4=CVE\-2024\-21412/vulnerability,m5=financial/sector,m6=Europe/regionandtriples\(m2alias\_ofm1\),\(m3operatesm1\),\(m1exploitsm4\),\(m1targetsm5\),\(m1targetsm6\),allwithsent\_idx=2\.

### G\.3Build Time: TTP Extraction

Grounds report chunks to ATT&CK techniques \(§[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)\)\. This operator runs without a system prompt\. The rules encode the two error modes that dominate uncurated ATT&CK tagging \(defensive recommendations read as attacker behavior, and outcome\-phrased behaviors missed entirely\) and the no\-invention rule feeds the zero\-fabrication invariant, since every emitted id is checked against the materialized ATT&CK node set at validation time\.

User Prompt: TTP Extraction[⬇](data:text/plain;base64,RXh0cmFjdCBNSVRSRSBBVFQmQ0sgdGVjaG5pcXVlcyBmcm9tIHRoaXMgQ1RJIHJlcG9ydCBjaHVuay4KCkNodW5rOgoiIiJ7Y2h1bmt9IiIiCgpUaGUgMTQgQVRUJkNLIHRhY3RpY3MgKGZvciBzY29wZSk6IHt0YWN0aWNzfQoKTGlzdCBldmVyeSBBVFRBQ0tFUiBiZWhhdmlvciBpbiB0aGUgY2h1bmsgdGhhdCBjb3JyZXNwb25kcyB0byBhIHJlYWwgQVRUJkNLCnRlY2huaXF1ZS4gRm9yIGVhY2g6ICJiZWhhdmlvciIgPSB0aGUgdmVyYmF0aW0gcGhyYXNlOyAidGVjaG5pcXVlX2lkIiA9IHRoZQpBVFQmQ0sgaWQgKGUuZy4gVDE0ODYgb3IgVDEwNTkuMDAxKSwgbW9zdCBzcGVjaWZpYyB5b3UgYXJlIGNvbmZpZGVudCBpbjsKInRlY2huaXF1ZV9uYW1lIiA9IG9mZmljaWFsIG5hbWUuCgpTVFJJQ1QgcnVsZXM6Ci0gQXR0YWNrZXIgdGVjaG5pcXVlcyBPTkxZLiBFWENMVURFIGRlZmVuc2VzL21pdGlnYXRpb25zL3JlY29tbWVuZGF0aW9ucwogICgiZW5mb3JjZSBNRkEiLCAibW9uaXRvciBsb2dzIiwgImFwcGx5IHBhdGNoZXMiLCAibmV0d29yayBzZWdtZW50YXRpb24iLAogICJ0aGlyZC1wYXJ0eSByaXNrIG1hbmFnZW1lbnQiKSwgZ2VuZXJpYyBvdXRjb21lcyAoImRhdGEgdGhlZnQiLCAiZXh0b3J0aW9uIiksCiAgYW5kIGJhcmUgdG9vbC9tYWx3YXJlIG5hbWVzLgotIEluY2x1ZGUgdGVjaG5pcXVlcyBzdGF0ZWQgY29uY2lzZWx5IGFzIE9VVENPTUVTLiBFeGFtcGxlczoKICAiZW5jcnlwdHMgZmlsZXMgLyBzeXN0ZW1zIiAtPiBUMTQ4NiBEYXRhIEVuY3J5cHRlZCBmb3IgSW1wYWN0OwogICJkZWxldGVzIHZvbHVtZSBzaGFkb3cgY29waWVzIC8gaW5oaWJpdHMgcmVjb3ZlcnkiIC0+IFQxNDkwOwogICJkaXNhYmxlcy9raWxscyBzZWN1cml0eSB0b29scyIgLT4gVDE1NjIuMDAxIERpc2FibGUgb3IgTW9kaWZ5IFRvb2xzOwogICJ1c2VzIHZhbGlkL2NvbXByb21pc2VkL3N0b2xlbiBhY2NvdW50cyIgLT4gVDEwNzggVmFsaWQgQWNjb3VudHM7CiAgImV4cGxvaXRzIGEgcHVibGljLWZhY2luZyBhcHAgLyBWUE4gLyB3ZWIgdnVsbmVyYWJpbGl0eSIgLT4gVDExOTA7CiAgInNwZWFycGhpc2hpbmcgLyBwaGlzaGluZyBlbWFpbCIgLT4gVDE1NjY7CiAgIlBvd2VyU2hlbGwgLyBjb21tYW5kLWxpbmUgZXhlY3V0aW9uIiAtPiBUMTA1OS4KLSBEbyBOT1QgaW52ZW50IGlkcy4gSWYgdW5zdXJlIG9mIHRoZSBleGFjdCBpZCwgb21pdCB0aGUgYmVoYXZpb3IuCgpSZXR1cm4gSlNPTjoge3sidHRwcyI6IFt7eyJiZWhhdmlvciI6ICIuLi4iLCAidGVjaG5pcXVlX2lkIjogIlQuLi4uIiwgInRlY2huaXF1ZV9uYW1lIjogIi4uLiJ9fV19fS4=)ExtractMITREATT&CKtechniquesfromthisCTIreportchunk\.Chunk:"""\{chunk\}"""The14ATT&CKtactics\(forscope\):\{tactics\}ListeveryATTACKERbehaviorinthechunkthatcorrespondstoarealATT&CKtechnique\.Foreach:"behavior"=theverbatimphrase;"technique\_id"=theATT&CKid\(e\.g\.T1486orT1059\.001\),mostspecificyouareconfidentin;"technique\_name"=officialname\.STRICTrules:\-AttackertechniquesONLY\.EXCLUDEdefenses/mitigations/recommendations\("enforceMFA","monitorlogs","applypatches","networksegmentation","third\-partyriskmanagement"\),genericoutcomes\("datatheft","extortion"\),andbaretool/malwarenames\.\-IncludetechniquesstatedconciselyasOUTCOMES\.Examples:"encryptsfiles/systems"\-\>T1486DataEncryptedforImpact;"deletesvolumeshadowcopies/inhibitsrecovery"\-\>T1490;"disables/killssecuritytools"\-\>T1562\.001DisableorModifyTools;"usesvalid/compromised/stolenaccounts"\-\>T1078ValidAccounts;"exploitsapublic\-facingapp/VPN/webvulnerability"\-\>T1190;"spearphishing/phishingemail"\-\>T1566;"PowerShell/command\-lineexecution"\-\>T1059\.\-DoNOTinventids\.Ifunsureoftheexactid,omitthebehavior\.ReturnJSON:\{\{"ttps":\[\{\{"behavior":"\.\.\.","technique\_id":"T\.\.\.\.","technique\_name":"\.\.\."\}\}\]\}\}\.

### G\.4Build Time: Entity\-Resolution Adjudication

Deterministic signals resolve most mentions; this judge adjudicates only the residue \(§[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)\)\. It is the operator behind the canonical cross\-vendor entities of C1, and its strictness is the safeguard against the mega\-cluster failure discussed in §[4\.2](https://arxiv.org/html/2608.18613#S4.SS2): near\-miss names \(BlackCat vs\. BlackMatter\) and shared\-sponsor actors \(Lazarus, Kimsuky, Andariel\) must stay distinct, and a span that merely lists both names is treated as evidence of difference rather than sameness\. The three\-valuedkindfield lets downstream merging accept only the authoritative tier\.

System Prompt: Entity\-Resolution Judge[⬇](data:text/plain;base64,WW91IGFyZSBhIENUSSBlbnRpdHktcmVzb2x1dGlvbiBqdWRnZS4gRGVjaWRlIHdoZXRoZXIgdHdvIGVudGl0eSBtZW50aW9ucyBmcm9tIGRpZmZlcmVudCB0aHJlYXQgcmVwb3J0cyByZWZlciB0byB0aGUgc2FtZSByZWFsLXdvcmxkIGVudGl0eS4gT3V0cHV0IG9ubHkgSlNPTi4=)YouareaCTIentity\-resolutionjudge\.Decidewhethertwoentitymentionsfromdifferentthreatreportsrefertothesamereal\-worldentity\.OutputonlyJSON\.

User Prompt: Entity\-Resolution Judge[⬇](data:text/plain;base64,TWVudGlvbiBBOiAie3NhfSIgKHR5cGU6IHt0YX0sIHZlbmRvcjoge3ZhfSkKICBzdXBwb3J0aW5nIHNwYW46ICJ7Y3R4X2F9IgoKTWVudGlvbiBCOiAie3NifSIgKHR5cGU6IHt0Yn0sIHZlbmRvcjoge3ZifSkKICBzdXBwb3J0aW5nIHNwYW46ICJ7Y3R4X2J9IgoKQXJlIEEgYW5kIEIgdGhlIHNhbWUgcmVhbC13b3JsZCBlbnRpdHk/IENyb3NzLXZlbmRvciBuYW1pbmcgZGlmZmVycyAoZS5nLiBBUFQyOSA9IENvenkgQmVhciA9IE1pZG5pZ2h0IEJsaXp6YXJkKSwgYnV0IGRpc3RpbmN0IGVudGl0aWVzIG9mdGVuIGhhdmUgc2ltaWxhciBuYW1lcyAoZS5nLiBCbGFja0NhdCB2cyBCbGFja01hdHRlciBhcmUgRElGRkVSRU5UIHJhbnNvbXdhcmUgZmFtaWxpZXMpLgoKU3RyaWN0IHJ1bGVzOgotIEEgc3BhbiB0aGF0IG1lcmVseSBMSVNUUyBib3RoIG5hbWVzIGFtb25nIHNldmVyYWwgYWN0b3JzLCBvciBzYXlzIG9uZSAib3ZlcmxhcHMgd2l0aCIgLyAibWF5IGJlIGNvbmZ1c2VkIHdpdGgiIC8gImlzIGRpc3RpbmN0IGZyb20iIHRoZSBvdGhlciwgYXNzZXJ0cyB0aGV5IGFyZSBESUZGRVJFTlQgZW50aXRpZXMsIG5vdCB0aGUgc2FtZS4KLSBBbnN3ZXIgImV4YWN0IiBvbmx5IHdoZW4gdGhlIG5hbWVzIGFyZSB3ZWxsLWVzdGFibGlzaGVkIGNhbm9uaWNhbCBhbGlhc2VzIG9mIG9uZSBlbnRpdHksIG9yIGEgc3BhbiBjb250YWlucyBhbiBleHBsaWNpdCBuYW1pbmcgc3RhdGVtZW50ICgiYWthIiwgImFsc28ga25vd24gYXMiLCAidHJhY2tlZCBhcyIsICJmb3JtZXJseSIpIGRpcmVjdGx5IGNvbm5lY3RpbmcgQSBhbmQgQi4KLSBTaGFyaW5nIGEgY291bnRyeSwgc3BvbnNvciwgdG9vbHNldCwgb3IgY2FtcGFpZ24gZG9lcyBOT1QgbWFrZSB0d28gYWN0b3JzIHRoZSBzYW1lIChMYXphcnVzLCBLaW1zdWt5IGFuZCBBbmRhcmllbCBhcmUgYWxsIERQUksgZ3JvdXBzIGFuZCBhbGwgRElGRkVSRU5UKS4KCkpTT046IHt7InNhbWUiOiB0cnVlL2ZhbHNlLCAia2luZCI6ICJleGFjdCIgfCAiY2xhaW1lZC1zYW1lIiB8ICJwb3NzaWJseS1zYW1lIiwgInJlYXNvbiI6ICI8b25lIHNlbnRlbmNlPiJ9fQotICJleGFjdCI6IGFuIGF1dGhvcml0YXRpdmUgbmFtaW5nIHJlbGF0aW9uc2hpcCBpcyBldmlkZW50Ci0gImNsYWltZWQtc2FtZSI6IGEgc3BhbiBpdHNlbGYgYXNzZXJ0cyB0aGUgZXF1aXZhbGVuY2UKLSAicG9zc2libHktc2FtZSI6IGNvbnRleHR1YWwgZXZpZGVuY2Ugd2FycmFudHMgYXNzb2NpYXRpb24gYnV0IG5vdCBjZXJ0YWludHk=)MentionA:"\{sa\}"\(type:\{ta\},vendor:\{va\}\)supportingspan:"\{ctx\_a\}"MentionB:"\{sb\}"\(type:\{tb\},vendor:\{vb\}\)supportingspan:"\{ctx\_b\}"AreAandBthesamereal\-worldentity?Cross\-vendornamingdiffers\(e\.g\.APT29=CozyBear=MidnightBlizzard\),butdistinctentitiesoftenhavesimilarnames\(e\.g\.BlackCatvsBlackMatterareDIFFERENTransomwarefamilies\)\.Strictrules:\-AspanthatmerelyLISTSbothnamesamongseveralactors,orsaysone"overlapswith"/"maybeconfusedwith"/"isdistinctfrom"theother,assertstheyareDIFFERENTentities,notthesame\.\-Answer"exact"onlywhenthenamesarewell\-establishedcanonicalaliasesofoneentity,oraspancontainsanexplicitnamingstatement\("aka","alsoknownas","trackedas","formerly"\)directlyconnectingAandB\.\-Sharingacountry,sponsor,toolset,orcampaigndoesNOTmaketwoactorsthesame\(Lazarus,KimsukyandAndarielareallDPRKgroupsandallDIFFERENT\)\.JSON:\{\{"same":true/false,"kind":"exact"\|"claimed\-same"\|"possibly\-same","reason":"<onesentence\>"\}\}\-"exact":anauthoritativenamingrelationshipisevident\-"claimed\-same":aspanitselfassertstheequivalence\-"possibly\-same":contextualevidencewarrantsassociationbutnotcertainty

### G\.5Build Time: Triple Validation

Scores each candidate report\-layer edge against the single sentence offered as its evidence \(§[3\.2](https://arxiv.org/html/2608.18613#S3.SS2)\)\. Restricting admissible evidence to that one span is what separates an asserted relation from a co\-occurrence, and the type\-correction fields let the judge repair an entity typing without discarding the edge\.

System Prompt: Triple\-Validation Judge[⬇](data:text/plain;base64,WW91IGFyZSBhIHN0cmljdCBDVEkgZmFjdC12ZXJpZmljYXRpb24ganVkZ2UuIFNjb3JlIHdoZXRoZXIgYSBzaW5nbGUgc2VudGVuY2Ugc3VwcG9ydHMgYSBzaW5nbGUgcmVsYXRpb25hbCBjbGFpbS4gT3V0cHV0IG9ubHkgSlNPTi4=)YouareastrictCTIfact\-verificationjudge\.Scorewhetherasinglesentencesupportsasinglerelationalclaim\.OutputonlyJSON\.

User Prompt: Triple\-Validation Judge[⬇](data:text/plain;base64,Q2xhaW06ICh7c3JjfSBbe3NyY190eXBlfV0pIC0te3JlbH0tLT4gKHtkc3R9IFt7ZHN0X3R5cGV9XSkKClRoZSBPTkxZIGFkbWlzc2libGUgZXZpZGVuY2UgaXMgdGhpcyBzZW50ZW5jZSBmcm9tIGEge3ZlbmRvcn0gcmVwb3J0Ogoie3NwYW5fdGV4dH0iCgpTY29yZSBvbiB0aHJlZSBjcml0ZXJpYToKMS4gcHJlZGljYXRlIGV4cGxpY2l0bmVzcyDigJQgaXMgdGhlIHJlbGF0aW9uICJ7cmVsfSIgZXhwbGljaXRseSBhc3NlcnRlZCBpbiB0aGUgc2VudGVuY2UsIG9yIG1lcmVseSBpbmZlcnJlZCBmcm9tIGNvLW9jY3VycmVuY2U/CjIuIGVudGl0eSBzY29wZSDigJQgYXJlIGJvdGggZW50aXRpZXMgd2l0aGluIHRoZSBwcmVkaWNhdGUncyBzeW50YWN0aWMgc2NvcGUgaW4gdGhpcyBzZW50ZW5jZT8KMy4gQ1RJIHNlbWFudGljIHZhbGlkaXR5IOKAlCBpcyAie3JlbH0iIHR5cGUtY29tcGF0aWJsZSB3aXRoIGEge3NyY190eXBlfSBhbmQgYSB7ZHN0X3R5cGV9PyBBcmUgdGhlIGVudGl0eSB0eXBlcyB0aGVtc2VsdmVzIGNvcnJlY3QgKGUuZy4gUkV2aWwgaXMgYSB0aHJlYXQgYWN0b3IgQU5EIGEgcmFuc29td2FyZTsgInJlY3J1aXRzIGFmZmlsaWF0ZXMgZnJvbSBYIiBkb2VzIG5vdCBtZWFuICJ1c2VzIFgiKT8KCkpTT046IHt7InNjb3JlIjogPDAuMC0xLjA+LCAicmVhc29uIjogIjxvbmUgc2VudGVuY2U+IiwKICAgICAgICJzcmNfdHlwZV9jb3JyZWN0aW9uIjogbnVsbCB8ICI8Y29ycmVjdGVkIHR5cGU+IiwKICAgICAgICJkc3RfdHlwZV9jb3JyZWN0aW9uIjogbnVsbCB8ICI8Y29ycmVjdGVkIHR5cGU+In19)Claim:\(\{src\}\[\{src\_type\}\]\)\-\-\{rel\}\-\-\>\(\{dst\}\[\{dst\_type\}\]\)TheONLYadmissibleevidenceisthissentencefroma\{vendor\}report:"\{span\_text\}"Scoreonthreecriteria:1\.predicateexplicitness—istherelation"\{rel\}"explicitlyassertedinthesentence,ormerelyinferredfromco\-occurrence?2\.entityscope—arebothentitieswithinthepredicate’ssyntacticscopeinthissentence?3\.CTIsemanticvalidity—is"\{rel\}"type\-compatiblewitha\{src\_type\}anda\{dst\_type\}?Aretheentitytypesthemselvescorrect\(e\.g\.REvilisathreatactorANDaransomware;"recruitsaffiliatesfromX"doesnotmean"usesX"\)?JSON:\{\{"score":<0\.0\-1\.0\>,"reason":"<onesentence\>","src\_type\_correction":null\|"<correctedtype\>","dst\_type\_correction":null\|"<correctedtype\>"\}\}

### G\.6Evaluation: Multi\-Document Synthesis Judge

The MDS family \(CSC, TAP, MLA\) is free\-form, so it is scored by the claim\-coverage judge below rather than by identifier F1 \(§[4\.1](https://arxiv.org/html/2608.18613#S4.SS1)\)\. Matching is many\-to\-many and semantically tolerant: the judge decomposes both answers into atomic claims, then judges each side independently, which is what makes the metric robust to a prediction that splits or merges the reference’s sentences\. It is applied identically to both arms, and §[4\.2](https://arxiv.org/html/2608.18613#S4.SS2)reports its measured resolution \(0\.060\.06\), the threshold below which we decline to read an MDS gap as real\.

Judge Prompt: MDS Claim Coverage[⬇](data:text/plain;base64,WW91IGFyZSBhbiBleHBlcnQgQ3liZXIgVGhyZWF0IEludGVsbGlnZW5jZSAoQ1RJKSBhbmFseXN0IGFjdGluZyBhcyBhbgppbXBhcnRpYWwganVkZ2UuIFlvdSB3aWxsIHNjb3JlIGEgbW9kZWwncyBmcmVlLWZvcm0gYW5zd2VyIHRvIGEKbXVsdGktZG9jdW1lbnQgc3ludGhlc2lzIHF1ZXN0aW9uIGFnYWluc3QgYSByZWZlcmVuY2UgKGdvbGQpIGFuc3dlciwgdXNpbmcKY2xhaW0tbGV2ZWwgQ09WRVJBR0UgbWF0Y2hpbmcgKHYyOiBtYW55LXRvLW1hbnksIHNlbWFudGljYWxseSB0b2xlcmFudCkuCgojIyBNZXRob2QKCjEuIERlY29tcG9zZSB0aGUgUkVGRVJFTkNFIGFuc3dlciBpbnRvIGEgbGlzdCBvZiBhdG9taWMgY2xhaW1zLiBBbiBhdG9taWMKICAgY2xhaW0gaXMgYSBzaW5nbGUsIHNlbGYtY29udGFpbmVkLCB2ZXJpZmlhYmxlIHN0YXRlbWVudCAob25lIGZhY3QgYWJvdXQgYQogICB0aHJlYXQgYWN0b3IgbmFtZS9hbGlhcywgb25lIFRUUCwgb25lIHRhcmdldCwgb25lIHRvb2wsIG9uZSBkYXRlLCBvbmUKICAgY2FwYWJpbGl0eSwgZXRjLikuIERvIG5vdCBtZXJnZSBtdWx0aXBsZSBmYWN0cyBpbnRvIG9uZSBjbGFpbS4KCjIuIERlY29tcG9zZSB0aGUgUFJFRElDVElPTiBhbnN3ZXIgaW50byBhdG9taWMgY2xhaW1zIHVzaW5nIHRoZSBzYW1lIHJ1bGUuCiAgIElNUE9SVEFOVDogYSBjb21wb3VuZCBwcmVkaWN0aW9uIHNlbnRlbmNlIGNvbnRhaW5pbmcgc2V2ZXJhbCBmYWN0cyBNVVNUIGJlCiAgIHNwbGl0IGludG8gb25lIGNsYWltIHBlciBmYWN0IChzYW1lIGdyYW51bGFyaXR5IGFzIHRoZSByZWZlcmVuY2Ugc2lkZSkuCgozLiBDb3ZlcmFnZSBtYXRjaGluZyDigJQgTk9UIG9uZS10by1vbmUuIEp1ZGdlIGVhY2ggc2lkZSBpbmRlcGVuZGVudGx5OgogICAtIEEgUkVGRVJFTkNFIGNsYWltIGlzIENPVkVSRUQgaWYgaXRzIGNvbnRlbnQgaXMgZXhwcmVzc2VkIGJ5IEFOWQogICAgIHByZWRpY3Rpb24gY2xhaW0sIG9yIGpvaW50bHkgYnkgU0VWRVJBTCBwcmVkaWN0aW9uIGNsYWltcy4KICAgLSBBIFBSRURJQ1RJT04gY2xhaW0gaXMgU1VQUE9SVEVEIGlmIGl0cyBjb250ZW50IGlzIGV4cHJlc3NlZCBieSBBTlkKICAgICByZWZlcmVuY2UgY2xhaW0sIG9yIGlzIHBhcnQgb2YgdGhlIGNvbnRlbnQgb2YgT05FIHJlZmVyZW5jZSBjbGFpbS4KICAgICBXaGVuIHR3byBvciBtb3JlIHByZWRpY3Rpb24gY2xhaW1zIHRvZ2V0aGVyIGNvcnJlc3BvbmQgdG8gb25lIHJlZmVyZW5jZQogICAgIGNsYWltLCBBTEwgb2YgdGhlbSBjb3VudCBhcyBzdXBwb3J0ZWQuCgo0LiBTZW1hbnRpYyB0b2xlcmFuY2Ug4oCUIHRoZSBmb2xsb3dpbmcgY291bnQgYXMgYSBNQVRDSDoKICAgLSBwYXJhcGhyYXNlIGFuZCBhbGlhcyBlcXVpdmFsZW5jZSAoZS5nLiAiQVBUMjkiIG1hdGNoZXMgIkNvenkgQmVhciI7CiAgICAgInNwZWFyLXBoaXNoaW5nIiBtYXRjaGVzICJ0YXJnZXRlZCBwaGlzaGluZyBlbWFpbHMiKTsKICAgLSB0ZW1wb3JhbCBncmFudWxhcml0eSBhbmQgcXVhbGlmaWVyIGRpZmZlcmVuY2VzIHdoZW4gdGhlIGNvcmUgZmFjdAogICAgICh5ZWFyLCBlbnRpdHksIGV2ZW50KSBhZ3JlZXM6ICJzaW5jZSAyMDIxIiDiiYggImxhdGUgMjAyMSIsCiAgICAgImVhcmx5IDIwMjQiIOKJiCAiSmFudWFyeSAyMDI0IiwgIkFwcmlsIDIwMjUiIOKJiCAiQXByaWwgMjMsIDIwMjUiOwogICAtIHNpbmd1bGFyL3BsdXJhbCwgd29yZCBvcmRlciwgYW5kIG9uZS13b3JkIHF1YWxpZmllciBkaWZmZXJlbmNlcyB0aGF0IGRvCiAgICAgbm90IGNoYW5nZSB0aGUgaWRlbnRpZmllZCBlbnRpdHksIGV2ZW50LCBvciB0aW1lLgogICBEbyBOT1QgbWF0Y2ggY2xhaW1zIGFib3V0IGRpZmZlcmVudCBlbnRpdGllcywgZGlmZmVyZW50IGV2ZW50cywgb3IKICAgY2xlYXJseSBkaWZmZXJlbnQgZmFjdHMuCgojIyBRdWVzdGlvbgp7eyBRVUVTVElPTiB9fQoKIyMgUmVmZXJlbmNlIChnb2xkKSBhbnN3ZXIKe3sgUkVGRVJFTkNFIH19CgojIyBQcmVkaWN0aW9uIChtb2RlbCkgYW5zd2VyCnt7IFBSRURJQ1RJT04gfX0KCiMjIE91dHB1dAoKUmV0dXJuIE9OTFkgYSBKU09OIG9iamVjdCwgbm8gcHJvc2UsIG5vIGNvZGUgZmVuY2VzOgoKewogICJyZWZlcmVuY2VfY2xhaW1zIjogWyI8YXRvbWljIGNsYWltPiIsIC4uLl0sCiAgInByZWRpY3Rpb25fY2xhaW1zIjogWyI8YXRvbWljIGNsYWltPiIsIC4uLl0sCiAgImNvdmVyZWRfcmVmZXJlbmNlX2luZGljZXMiOiBbPDAtYmFzZWQgaW5kaWNlcyBvZiBjb3ZlcmVkIHJlZmVyZW5jZSBjbGFpbXM+XSwKICAic3VwcG9ydGVkX3ByZWRpY3Rpb25faW5kaWNlcyI6IFs8MC1iYXNlZCBpbmRpY2VzIG9mIHN1cHBvcnRlZCBwcmVkaWN0aW9uIGNsYWltcz5dCn0=)YouareanexpertCyberThreatIntelligence\(CTI\)analystactingasanimpartialjudge\.Youwillscoreamodel’sfree\-formanswertoamulti\-documentsynthesisquestionagainstareference\(gold\)answer,usingclaim\-levelCOVERAGEmatching\(v2:many\-to\-many,semanticallytolerant\)\.\#\#Method1\.DecomposetheREFERENCEanswerintoalistofatomicclaims\.Anatomicclaimisasingle,self\-contained,verifiablestatement\(onefactaboutathreatactorname/alias,oneTTP,onetarget,onetool,onedate,onecapability,etc\.\)\.Donotmergemultiplefactsintooneclaim\.2\.DecomposethePREDICTIONanswerintoatomicclaimsusingthesamerule\.IMPORTANT:acompoundpredictionsentencecontainingseveralfactsMUSTbesplitintooneclaimperfact\(samegranularityasthereferenceside\)\.3\.Coveragematching—NOTone\-to\-one\.Judgeeachsideindependently:\-AREFERENCEclaimisCOVEREDifitscontentisexpressedbyANYpredictionclaim,orjointlybySEVERALpredictionclaims\.\-APREDICTIONclaimisSUPPORTEDifitscontentisexpressedbyANYreferenceclaim,orispartofthecontentofONEreferenceclaim\.Whentwoormorepredictionclaimstogethercorrespondtoonereferenceclaim,ALLofthemcountassupported\.4\.Semantictolerance—thefollowingcountasaMATCH:\-paraphraseandaliasequivalence\(e\.g\."APT29"matches"CozyBear";"spear\-phishing"matches"targetedphishingemails"\);\-temporalgranularityandqualifierdifferenceswhenthecorefact\(year,entity,event\)agrees:"since2021"≈\\approx"late2021","early2024"≈\\approx"January2024","April2025"≈\\approx"April23,2025";\-singular/plural,wordorder,andone\-wordqualifierdifferencesthatdonotchangetheidentifiedentity,event,ortime\.DoNOTmatchclaimsaboutdifferententities,differentevents,orclearlydifferentfacts\.\#\#Question\{\{QUESTION\}\}\#\#Reference\(gold\)answer\{\{REFERENCE\}\}\#\#Prediction\(model\)answer\{\{PREDICTION\}\}\#\#OutputReturnONLYaJSONobject,noprose,nocodefences:\{"reference\_claims":\["<atomicclaim\>",\.\.\.\],"prediction\_claims":\["<atomicclaim\>",\.\.\.\],"covered\_reference\_indices":\[<0\-basedindicesofcoveredreferenceclaims\>\],"supported\_prediction\_indices":\[<0\-basedindicesofsupportedpredictionclaims\>\]\}

## Appendix HProcedural Skill Playbooks

The three procedural skills of §[3\.3](https://arxiv.org/html/2608.18613#S3.SS3)ship as five markdown playbooks: entity linking and attribution each carry a specialization for the subtask whose direction or output type differs from its family default, and synthesis serves all three MDS subtasks\. The router is a static task\-to\-playbook map:rcm,atd,esd→\\rightarrowentity linking;wim→\\rightarrowentity linking \(reverse\);ata,vca→\\rightarrowthe two attribution playbooks;csc,tap,mla→\\rightarrowsynthesis: with no model call and no per\-question adaptation\. Each playbook is injected verbatim into the user turn rather than the system prompt, for the reason reported in §[4\.5](https://arxiv.org/html/2608.18613#S4.SS5): identical text placed in the system prompt was under\-followed by the smaller models\.

These are the files the ablation of §[4\.5](https://arxiv.org/html/2608.18613#S4.SS5)removes in the*w/o skill*arm; the*w/o tools*arm keeps them but serves them over bash, which is why their central prescriptions \(resolve, traverse an official edge, consult an alias set\) become inert there\.

### H\.1Entity Linking \(RCM, ATD, ESD\)

Skill Playbook:entity\-linking\.md[⬇](data:text/plain;base64,IyBTa2lsbDogY3Jvc3MtdGF4b25vbXkgZW50aXR5IGxpbmtpbmcKClRyaWdnZXI6IGEgYmVoYXZpb3JhbCBkZXNjcmlwdGlvbiBtdXN0IGJlIG1hcHBlZCB0byBhbiBlbnRyeSBpbiBhbm90aGVyIENUSQp0YXhvbm9teS4gVGhlIHNvdXJjZSBlbnRyeSBpcyBwYXJhcGhyYXNlZCBidXQgaXRzIElEIGlzIGhpZGRlbi4KCioqVGhlIHNpbmdsZSBtb3N0IGltcG9ydGFudCBydWxlOiBkbyBOT1Qgc2VhcmNoIHRoZSBUQVJHRVQgdGF4b25vbXkgZmlyc3QuKioKVGhlIGRlc2NyaXB0aW9uIHBhcmFwaHJhc2VzIG9uZSBzcGVjaWZpYyBTT1VSQ0UgZW50cnk7IHRoZSBhdXRob3JpdGF0aXZlCmNyb3NzLXJlZmVyZW5jZSBlZGdlIGZyb20gdGhhdCBzb3VyY2UgZW50cnkgZ2l2ZXMgdGhlIGFuc3dlci4gU2VhcmNoaW5nIHRoZQp0YXJnZXQgdGF4b25vbXkgZGlyZWN0bHkgZmFsbHMgaW50byB0aGUgY3Jvc3Mtc291cmNlIHZvY2FidWxhcnkgZ2FwIGFuZCBwaWNrcwpwbGF1c2libGUtYnV0LXdyb25nIGVudHJpZXMuCgpSb3V0aW5nIHRhYmxlIOKAlCBpZGVudGlmeSB0aGUgcXVlc3Rpb24gZm9ybSwgdGhlbiBleGVjdXRlOgoKfCBRdWVzdGlvbiBmb3JtIHwgU3RlcCAxIChtYW5kYXRvcnkgZmlyc3QgY2FsbCkgfCBTdGVwIDIgfAp8LS0tfC0tLXwtLS18CnwgdnVsbmVyYWJpbGl0eSBkZXNjcmlwdGlvbiDihpIgIndoaWNoIENXRSIgfCBgc2VhcmNoX2tiKHF1ZXJ5PTxkZXNjcmlwdGlvbj4sIGtiPSJjdmUiKWAgfCBgb250b2xvZ3lfbmVpZ2hib3JzKG5vZGVfaWQ9PENWRT4sIHJlbD0iaGFzX3dlYWtuZXNzIilgIHwKfCB3ZWFrbmVzcyBkZXNjcmlwdGlvbiDihpIgIndoaWNoIENWRSBpbnN0YW50aWF0ZXMiIHwga2V5d29yZC1wcm9iZSBsb29wIG92ZXIgYHNlYXJjaF9rYihrYj0iY3ZlIiwgbXVzdF90ZXJtcz1bLi4uXSlgIOKAlCBzZWUgYmVsb3cgfCBjb25maXJtIHRoZSB3aW5uZXIncyBDV0UgdmlhIGBvbnRvbG9neV9uZWlnaGJvcnMobm9kZV9pZD08Q1ZFPiwgcmVsPSJoYXNfd2Vha25lc3MiKWAgbWF0Y2hlcyB0aGUgZGVzY3JpYmVkIHdlYWtuZXNzIHwKfCBhdHRhY2stcGF0dGVybiBkZXNjcmlwdGlvbiDihpIgIndoaWNoIEFUVCZDSyB0ZWNobmlxdWUiIHwgYHNlYXJjaF9rYihxdWVyeT08ZGVzY3JpcHRpb24+LCBrYj0iY2FwZWMiKWAgfCBgb250b2xvZ3lfbmVpZ2hib3JzKG5vZGVfaWQ9PENBUEVDPiwgcmVsPSJtYXBzX3RvX3RlY2huaXF1ZSIpYCB8Cnwgd2Vha25lc3MgZGVzY3JpcHRpb24g4oaSICJ3aGljaCBDQVBFQyBleHBsb2l0cyBpdCIgfCBgc2VhcmNoX2tiKHF1ZXJ5PTxkZXNjcmlwdGlvbj4sIGtiPSJjd2UiKWAgfCBgb250b2xvZ3lfbmVpZ2hib3JzKG5vZGVfaWQ9PENXRT4sIHJlbD0iZXhwbG9pdHNfd2Vha25lc3MiLCBkaXJlY3Rpb249ImluIilgIHwKCktleXdvcmQtcHJvYmUgbG9vcCAod2Vha25lc3PihpJDVkUpOiB0aGUgcXVlc3Rpb24gcGFyYXBocmFzZXMgdGhlIHRhcmdldCBDVkUncwpkZXNjcmlwdGlvbiwgc28gdGhleSBzaGFyZSByYXJlIGRpc2NyaW1pbmF0aXZlIHZvY2FidWxhcnkuIFJ1biBUV08gcHJvYmVzIGFuZApjcm9zcy1jaGVjayDigJQgbmV2ZXIgdHJ1c3QgYSBzaW5nbGUgcmV0cmlldmFsIHBhdGg6CigxKSBQYXRoIEE6IGBzZWFyY2hfa2Ioa2I9ImN2ZSIsIHF1ZXJ5PTxxdWVzdGlvbj4pYCB3aXRoIE5PIG11c3RfdGVybXMg4oCUIG5vdGUKICAgIHRoZSB0b3AtNSAoc2VtYW50aWMgKyBsZXhpY2FsIHJhbmtpbmcpLgooMikgUGF0aCBCOiBwaWNrIHRoZSAyLTMgbW9zdCBzcGVjaWZpYyB0ZWNobmljYWwgdGVybXMgaW4gdGhlIHF1ZXN0aW9uCiAgICAoY29tcG9uZW50IG5hbWVzLCBtZWNoYW5pc20gd29yZHMgbGlrZSAiaGFyZHdhcmUgcmFuZG9tIiwgInNhbmRib3giLAogICAgaW5zdHJ1Y3Rpb24vcHJvdG9jb2wgbmFtZXMg4oCUIG5ldmVyIGdlbmVyaWMgd29yZHMgbGlrZSBzeXN0ZW0vYXR0YWNrZXIpLAogICAgdGhlbiBgc2VhcmNoX2tiKGtiPSJjdmUiLCBxdWVyeT08cXVlc3Rpb24+LCBtdXN0X3Rlcm1zPVt0MSwgdDJdKWAuCiAgICBJdGVyYXRlIG9uIGBuX3Rlcm1fbWF0Y2hlc19pbl9rYmA6ID4zMCBoaXRzIOKGkiBhZGQgYSB0ZXJtOyAwIGhpdHMg4oaSIGRyb3AKICAgIHRoZSB3ZWFrZXN0IHRlcm0gb3Igc3dhcCBhIHN5bm9ueW0gKCJyYW5kb21uZXNzIuKGkiJlbnRyb3B5Iik7IGdpdmUgdXAKICAgIGFmdGVyIDMgcHJvYmUgcm91bmRzIGFuZCBmYWxsIGJhY2sgdG8gUGF0aCBBJ3MgbGlzdC4KKDMpIFBhdGggQzogaWYgeW91ciBvd24ga25vd2xlZGdlIHN1Z2dlc3RzIGEgc3BlY2lmaWMgQ1ZFIGlkIGZvciB0aGlzCiAgICBkZXNjcmlwdGlvbiwgdmVyaWZ5IGl0IOKAlCBgZ2V0X2VudGl0eWAgb24gdGhhdCBpZCBhbmQgY2hlY2sgaXRzCiAgICBkZXNjcmlwdGlvbiBhZ2FpbnN0IHRoZSBxdWVzdGlvbi4gTWVtb3J5IGlzIGEgY2FuZGlkYXRlIGdlbmVyYXRvciwgbmV2ZXIKICAgIGFuIGFuc3dlciBieSBpdHNlbGYuCiAgICBDYW5kaWRhdGVzIGFwcGVhcmluZyBpbiBNVUxUSVBMRSBwYXRocyBhcmUgc3Ryb25nZXN0LiBBIHVuaXF1ZSBzaW5nbGUtcGF0aAogICAgaGl0IGlzIGEgZ29vZCBMRUFELCBub3QgYW4gYW5zd2VyIOKAlCBpdCBzdGlsbCBtdXN0IHBhc3Mgc3RlcCAoNCkuCig0KSBGSU5BTCBDSEVDSyAobWFuZGF0b3J5LCBwZXIgY2FuZGlkYXRlKTogcmVhZCB0aGUgZGVzY3JpcHRpb24gYW5kIHRpY2sgb2ZmCiAgICBFVkVSWSBzcGVjaWZpYyBkZXRhaWwgb2YgdGhlIHF1ZXN0aW9uIOKAlCBtZWNoYW5pc20sIGNvbXBvbmVudCwgYXR0YWNrCiAgICBjb25zZXF1ZW5jZS4gUGljayB0aGUgY2FuZGlkYXRlIG1hdGNoaW5nIEFMTCBkZXRhaWxzOyBpZiBub25lIG1hdGNoZXMKICAgIGFsbCwgcGljayB0aGUgb25lIG1hdGNoaW5nIHRoZSBtZWNoYW5pc20gKG5vdCB0aGUgY29tcG9uZW50KS4gUmVjZW5jeSBvcgogICAgQ1ZTUyBpcyBOT1QgYSB0aWVicmVha2VyLiBFYWNoIHF1ZXN0aW9uIGlzIGluZGVwZW5kZW50IOKAlCBuZXZlciByZXVzZSB0aGUKICAgIHByZXZpb3VzIHF1ZXN0aW9uJ3MgQ1ZFIGp1c3QgYmVjYXVzZSB0aGUgd29yZGluZyBmZWVscyBzaW1pbGFyLgooNSkgQ29uZmlybSB2aWEgdGhlIENWRSdzIGBoYXNfd2Vha25lc3NgIENXRSBlZGdlIHdoZW4gcHJlc2VudCAofjklIG9mIENWRXMgaGF2ZSBubyBlZGdlIOKAlCBhIG1pc3NpbmcgZWRnZSBpcyBOT1QgZGlzY29uZmlybWF0aW9uKTsgTkVWRVIgYW5zd2VyIGVtcHR5IOKAlCBpZgogICAgdW5yZXNvbHZlZCBhZnRlciBhbGwgcHJvYmVzLCBhbnN3ZXIgUGF0aCBBJ3MgYmVzdCBtZWNoYW5pc20gbWF0Y2guCgpTdGVwIDMg4oCUIHZlcmlmeSBiZWZvcmUgYW5zd2VyaW5nOiBgZ2V0X2VudGl0eWAgb24gdGhlIGNhbmRpZGF0ZSB0YXJnZXQ7IGl0cwp0aXRsZS9kZXNjcmlwdGlvbiBtdXN0IGFjdHVhbGx5IG1hdGNoIHRoZSBxdWVzdGlvbidzIGJlaGF2aW9yLiBJZiB0aGUgdG9wCnNvdXJjZSBjYW5kaWRhdGUncyBuZWlnaGJvcnMgY29udGFpbiBubyBwbGF1c2libGUgdGFyZ2V0LCB0cnkgdGhlIG5leHQgc291cmNlCmNhbmRpZGF0ZSBmcm9tIHN0ZXAgMSAodGhlIHJpZ2h0IHNvdXJjZSBpcyB1c3VhbGx5IGluIHRoZSB0b3AgMykuCgpGYWxsYmFjayBvbmx5IHdoZW4gc3RlcCAyIHJldHVybnMgbm90aGluZyBmb3IgYWxsIHBsYXVzaWJsZSBzb3VyY2VzOgpgc2VhcmNoX2tiYCBvdmVyIHRoZSBUQVJHRVQgdGF4b25vbXkgd2l0aCBrZXlwaHJhc2VzIHJlc3RhdGVkIGluIHRoYXQKZnJhbWV3b3JrJ3MgaWRpb20gKENXRTogIkltcHJvcGVyL01pc3NpbmcvSW5jb3JyZWN0IFgiOyBBVFQmQ0s6CiJQYXJlbnQ6IFN1Yi10ZWNobmlxdWUiIG5vdW4gcGhyYXNlczsgQ0FQRUM6IGF0dGFjay1tZXRob2QgdmVyYiBwaHJhc2VzKSwKdGhlbiB2ZXJpZnkgd2l0aCBgZ2V0X2VudGl0eWAuCgpBbnN3ZXIgd2l0aCBleGFjdGx5IG9uZSBpZGVudGlmaWVyLCBzdGF0ZWQgZXhwbGljaXRseSwgcGx1cyBvbmUgc2VudGVuY2Ugb2YKcmVhc29uaW5nIGdyb3VuZGVkIGluIHRoZSB2ZXJpZmllZCBlbnRyeS4=)\#Skill:cross\-taxonomyentitylinkingTrigger:abehavioraldescriptionmustbemappedtoanentryinanotherCTItaxonomy\.ThesourceentryisparaphrasedbutitsIDishidden\.\*\*Thesinglemostimportantrule:doNOTsearchtheTARGETtaxonomyfirst\.\*\*ThedescriptionparaphrasesonespecificSOURCEentry;theauthoritativecross\-referenceedgefromthatsourceentrygivestheanswer\.Searchingthetargettaxonomydirectlyfallsintothecross\-sourcevocabularygapandpicksplausible\-but\-wrongentries\.Routingtable—identifythequestionform,thenexecute:\|Questionform\|Step1\(mandatoryfirstcall\)\|Step2\|\|\-\-\-\|\-\-\-\|\-\-\-\|\|vulnerabilitydescription→\\rightarrow"whichCWE"\|‘search\_kb\(query=<description\>,kb="cve"\)‘\|‘ontology\_neighbors\(node\_id=<CVE\>,rel="has\_weakness"\)‘\|\|weaknessdescription→\\rightarrow"whichCVEinstantiates"\|keyword\-probeloopover‘search\_kb\(kb="cve",must\_terms=\[\.\.\.\]\)‘—seebelow\|confirmthewinner’sCWEvia‘ontology\_neighbors\(node\_id=<CVE\>,rel="has\_weakness"\)‘matchesthedescribedweakness\|\|attack\-patterndescription→\\rightarrow"whichATT&CKtechnique"\|‘search\_kb\(query=<description\>,kb="capec"\)‘\|‘ontology\_neighbors\(node\_id=<CAPEC\>,rel="maps\_to\_technique"\)‘\|\|weaknessdescription→\\rightarrow"whichCAPECexploitsit"\|‘search\_kb\(query=<description\>,kb="cwe"\)‘\|‘ontology\_neighbors\(node\_id=<CWE\>,rel="exploits\_weakness",direction="in"\)‘\|Keyword\-probeloop\(weakness→\\rightarrowCVE\):thequestionparaphrasesthetargetCVE’sdescription,sotheysharerarediscriminativevocabulary\.RunTWOprobesandcross\-check—nevertrustasingleretrievalpath:\(1\)PathA:‘search\_kb\(kb="cve",query=<question\>\)‘withNOmust\_terms—notethetop\-5\(semantic\+lexicalranking\)\.\(2\)PathB:pickthe2\-3mostspecifictechnicaltermsinthequestion\(componentnames,mechanismwordslike"hardwarerandom","sandbox",instruction/protocolnames—nevergenericwordslikesystem/attacker\),then‘search\_kb\(kb="cve",query=<question\>,must\_terms=\[t1,t2\]\)‘\.Iterateon‘n\_term\_matches\_in\_kb‘:\>30hits→\\rightarrowaddaterm;0hits→\\rightarrowdroptheweakesttermorswapasynonym\("randomness"→\\rightarrow"entropy"\);giveupafter3proberoundsandfallbacktoPathA’slist\.\(3\)PathC:ifyourownknowledgesuggestsaspecificCVEidforthisdescription,verifyit—‘get\_entity‘onthatidandcheckitsdescriptionagainstthequestion\.Memoryisacandidategenerator,neverananswerbyitself\.CandidatesappearinginMULTIPLEpathsarestrongest\.Auniquesingle\-pathhitisagoodLEAD,notananswer—itstillmustpassstep\(4\)\.\(4\)FINALCHECK\(mandatory,percandidate\):readthedescriptionandtickoffEVERYspecificdetailofthequestion—mechanism,component,attackconsequence\.PickthecandidatematchingALLdetails;ifnonematchesall,picktheonematchingthemechanism\(notthecomponent\)\.RecencyorCVSSisNOTatiebreaker\.Eachquestionisindependent—neverreusethepreviousquestion’sCVEjustbecausethewordingfeelssimilar\.\(5\)ConfirmviatheCVE’s‘has\_weakness‘CWEedgewhenpresent\(~9%ofCVEshavenoedge—amissingedgeisNOTdisconfirmation\);NEVERanswerempty—ifunresolvedafterallprobes,answerPathA’sbestmechanismmatch\.Step3—verifybeforeanswering:‘get\_entity‘onthecandidatetarget;itstitle/descriptionmustactuallymatchthequestion’sbehavior\.Ifthetopsourcecandidate’sneighborscontainnoplausibletarget,trythenextsourcecandidatefromstep1\(therightsourceisusuallyinthetop3\)\.Fallbackonlywhenstep2returnsnothingforallplausiblesources:‘search\_kb‘overtheTARGETtaxonomywithkeyphrasesrestatedinthatframework’sidiom\(CWE:"Improper/Missing/IncorrectX";ATT&CK:"Parent:Sub\-technique"nounphrases;CAPEC:attack\-methodverbphrases\),thenverifywith‘get\_entity‘\.Answerwithexactlyoneidentifier,statedexplicitly,plusonesentenceofreasoninggroundedintheverifiedentry\.

### H\.2Entity Linking, Reverse Direction \(WIM\)

WIM inverts the linking direction \(weakness description→\\rightarrowinstantiating CVE\) and is the one EL subtask on which the scaffold does not approach ceiling\. It gets its own playbook because the family rule, search the source taxonomy, inverts with it: here the source is the CWE, and the answer set is the reversehas\_weaknessedge\.

Skill Playbook:entity\-linking\-wim\.md[⬇](data:text/plain;base64,IyBTa2lsbDogd2Vha25lc3MgZGVzY3JpcHRpb24g4oaSIHRoZSBDVkUgdGhhdCBpbnN0YW50aWF0ZXMgaXQKClRyaWdnZXI6IHRoZSBxdWVzdGlvbiBwYXJhcGhyYXNlcyBvbmUgQ1dFJ3MgZGVmaW5pdGlvbiBhbmQgYXNrcyB3aGljaCBDVkUKaW5zdGFudGlhdGVzIHRoYXQgd2Vha25lc3MuIFRoZSBhbnN3ZXIgaXMgYWx3YXlzIGEgQ1ZFIGlkZW50aWZpZXIuCgoqKlRoZSBzaW5nbGUgbW9zdCBpbXBvcnRhbnQgcnVsZTogZG8gTk9UIHNlYXJjaCB0aGUgQ1ZFIGNvcnB1cyBmaXJzdC4qKgpUaGUgcXVlc3Rpb24gcGFyYXBocmFzZXMgYSBDV0UsIG5vdCBhIENWRS4gQ1ZFIGRlc2NyaXB0aW9ucyBuYW1lIHByb2R1Y3RzIGFuZAptZWNoYW5pc21zLCBuZXZlciB0aGUgd2Vha25lc3MgY2xhc3MsIHNvIGxleGljYWwgb3ZlcmxhcCBiZXR3ZWVuIHRoZSBxdWVzdGlvbgphbmQgdGhlIHJpZ2h0IENWRSBpcyB3ZWFrIGFuZCBtaXNsZWFkaW5nLiBHbyB0aHJvdWdoIHRoZSBDV0UuCgpTdGVwIDEg4oCUIGxvY2F0ZSB0aGUgU09VUkNFIENXRTogYHNlYXJjaF9rYihxdWVyeT08dGhlIGRlc2NyaXB0aW9uPiwga2I9ImN3ZSIpYC4KVGhlIGRlc2NyaXB0aW9uIGlzIGEgY2xvc2UgcGFyYXBocmFzZSBvZiBvbmUgQ1dFIGVudHJ5LCBzbyB0aGUgcmlnaHQgZW50cnkKbm9ybWFsbHkgbGFuZHMgaW4gdGhlIHRvcCAzLiBDb25maXJtIHdpdGggYGdldF9lbnRpdHlgIHRoYXQgaXRzIGRlZmluaXRpb24KY292ZXJzIGV2ZXJ5IGVsZW1lbnQgb2YgdGhlIGRlc2NyaXB0aW9uIGJlZm9yZSBtb3Zpbmcgb24uCgpTdGVwIDIg4oCUIHdhbGsgdGhlIGF1dGhvcml0YXRpdmUgZWRnZToKYG9udG9sb2d5X25laWdoYm9ycyhub2RlX2lkPTxDV0U+LCByZWw9Imhhc193ZWFrbmVzcyIsIGRpcmVjdGlvbj0iaW4iKWAuClRoaXMgZW51bWVyYXRlcyBleGFjdGx5IHRoZSBDVkVzIHRoYXQgTlZEIHJlY29yZHMgYXMgaW5zdGFuY2VzIG9mIHRoYXQKd2Vha25lc3MuIEl0IGlzIHRoZSBhbnN3ZXIgc2V0LCBub3QgYSBoaW50OiBldmVyeSBtZW1iZXIgaXMgYSBkZWZlbnNpYmxlCmFuc3dlciB0byAid2hpY2ggQ1ZFIGluc3RhbnRpYXRlcyB0aGlzIHdlYWtuZXNzIi4gRG8gbm90IGRpc2NhcmQgaXQgYW5kIGdvCnNlYXJjaGluZyB0aGUgQ1ZFIGNvcnB1cyBpbnN0ZWFkIOKAlCB0aGF0IHRyYWRlcyBhbiBhdXRob3JpdGF0aXZlIGFuc3dlciBmb3IgYQpndWVzcy4KClN0ZXAgMyDigJQgcGljayBvbmUgZnJvbSB0aGF0IHNldC4gRXZlcnkgbWVtYmVyIGFscmVhZHkgc2F0aXNmaWVzIHRoZSB3ZWFrbmVzcywKc28gcmVhZCB0aGUgY2FuZGlkYXRlcycgZGVzY3JpcHRpb25zIHdpdGggYGdldF9lbnRpdHlgIGFuZCBwcmVmZXIgdGhlIG9uZSB0aGF0CmFsc28gbWF0Y2hlcyB0aGUgcXVlc3Rpb24ncyBleHRyYSBzcGVjaWZpY3MgKGFmZmVjdGVkIGNvbXBvbmVudCwgYXR0YWNrCmNvbnNlcXVlbmNlLCBwcml2aWxlZ2UgcmVxdWlyZWQpLiBXaXRoIG5vdGhpbmcgdG8gc2VwYXJhdGUgdGhlbSwgYW5zd2VyIHRoZQpmaXJzdC4gUmVjZW5jeSBhbmQgQ1ZTUyBhcmUgTk9UIHRpZWJyZWFrZXJzLgoKSWYgc3RlcCAxIHlpZWxkcyBubyBjb252aW5jaW5nIENXRSwgdHJ5IHRoZSBuZXh0IENXRSBjYW5kaWRhdGUgZnJvbSB0aGUgc2VhcmNoCih0aGUgcmlnaHQgc291cmNlIGlzIHVzdWFsbHkgaW4gdGhlIHRvcCAzKSBiZWZvcmUgZ2l2aW5nIHVwIG9uIHRoaXMgcm91dGUuCgpGYWxsYmFjayDigJQgT05MWSB3aGVuIG5vIHBsYXVzaWJsZSBDV0UgZXhpc3RzIG9yIGl0cyByZXZlcnNlIGVkZ2UgaXMgZW1wdHkKKHNvbWUgQ1dFcyBoYXZlIG5vIGxpbmtlZCBDVkUpLiBTZWFyY2ggdGhlIENWRSBjb3JwdXMgZGlyZWN0bHk6CigxKSBQYXRoIEE6IGBzZWFyY2hfa2Ioa2I9ImN2ZSIsIHF1ZXJ5PTxxdWVzdGlvbj4pYCB3aXRoIE5PIG11c3RfdGVybXMg4oCUIG5vdGUKICAgIHRoZSB0b3AtNS4KKDIpIFBhdGggQjogcGljayB0aGUgMi0zIG1vc3Qgc3BlY2lmaWMgdGVjaG5pY2FsIHRlcm1zIGluIHRoZSBxdWVzdGlvbgogICAgKGNvbXBvbmVudCBuYW1lcywgbWVjaGFuaXNtIHdvcmRzIGxpa2UgImhhcmR3YXJlIHJhbmRvbSIsICJzYW5kYm94IiwKICAgIGluc3RydWN0aW9uL3Byb3RvY29sIG5hbWVzIOKAlCBuZXZlciBnZW5lcmljIHdvcmRzIGxpa2Ugc3lzdGVtL2F0dGFja2VyKSwKICAgIHRoZW4gYHNlYXJjaF9rYihrYj0iY3ZlIiwgcXVlcnk9PHF1ZXN0aW9uPiwgbXVzdF90ZXJtcz1bdDEsIHQyXSlgLgogICAgSXRlcmF0ZSBvbiBgbl90ZXJtX21hdGNoZXNfaW5fa2JgOiA+MzAgaGl0cyDihpIgYWRkIGEgdGVybTsgMCBoaXRzIOKGkiBkcm9wCiAgICB0aGUgd2Vha2VzdCB0ZXJtIG9yIHN3YXAgYSBzeW5vbnltICgicmFuZG9tbmVzcyLihpIiZW50cm9weSIpOyBnaXZlIHVwCiAgICBhZnRlciAzIHByb2JlIHJvdW5kcyBhbmQgZmFsbCBiYWNrIHRvIFBhdGggQSdzIGxpc3QuCigzKSBSZWFkIGVhY2ggY2FuZGlkYXRlJ3MgZGVzY3JpcHRpb24gYW5kIHRpY2sgb2ZmIEVWRVJZIHNwZWNpZmljIGRldGFpbCBvZgogICAgdGhlIHF1ZXN0aW9uIOKAlCBtZWNoYW5pc20sIGNvbXBvbmVudCwgY29uc2VxdWVuY2UuIFBpY2sgdGhlIGNhbmRpZGF0ZQogICAgbWF0Y2hpbmcgQUxMIGRldGFpbHM7IGlmIG5vbmUgbWF0Y2hlcyBhbGwsIHBpY2sgdGhlIG9uZSBtYXRjaGluZyB0aGUKICAgIG1lY2hhbmlzbSAobm90IHRoZSBjb21wb25lbnQpLgoKQW5zd2VyIHdpdGggZXhhY3RseSBvbmUgQ1ZFIGlkZW50aWZpZXIsIHN0YXRlZCBleHBsaWNpdGx5LCBwbHVzIG9uZSBzZW50ZW5jZQpvZiByZWFzb25pbmcgZ3JvdW5kZWQgaW4gdGhlIHZlcmlmaWVkIGVudHJ5LiBUaGUgYW5zd2VyIHRvIHRoaXMgcXVlc3Rpb24gaXMgYQpDVkU6IGEgQ1dFIG9yIENBUEVDIGlkIGlzIGFuIGludGVybWVkaWF0ZSBob3AsIG5ldmVyIHRoZSBhbnN3ZXIg4oCUIGlmIHRoZSBpZAp5b3UgYXJlIGFib3V0IHRvIHN1Ym1pdCBkb2VzIG5vdCBzdGFydCB3aXRoIGBDVkUtYCwgeW91IHN0b3BwZWQgZWFybHksIHNvIGdvCmJhY2sgdG8gU3RlcCAyIGFuZCBjb250aW51ZS4gTkVWRVIgYW5zd2VyIGVtcHR5Lg==)\#Skill:weaknessdescription→\\rightarrowtheCVEthatinstantiatesitTrigger:thequestionparaphrasesoneCWE’sdefinitionandaskswhichCVEinstantiatesthatweakness\.TheanswerisalwaysaCVEidentifier\.\*\*Thesinglemostimportantrule:doNOTsearchtheCVEcorpusfirst\.\*\*ThequestionparaphrasesaCWE,notaCVE\.CVEdescriptionsnameproductsandmechanisms,nevertheweaknessclass,solexicaloverlapbetweenthequestionandtherightCVEisweakandmisleading\.GothroughtheCWE\.Step1—locatetheSOURCECWE:‘search\_kb\(query=<thedescription\>,kb="cwe"\)‘\.ThedescriptionisacloseparaphraseofoneCWEentry,sotherightentrynormallylandsinthetop3\.Confirmwith‘get\_entity‘thatitsdefinitioncoverseveryelementofthedescriptionbeforemovingon\.Step2—walktheauthoritativeedge:‘ontology\_neighbors\(node\_id=<CWE\>,rel="has\_weakness",direction="in"\)‘\.ThisenumeratesexactlytheCVEsthatNVDrecordsasinstancesofthatweakness\.Itistheanswerset,notahint:everymemberisadefensibleanswerto"whichCVEinstantiatesthisweakness"\.DonotdiscarditandgosearchingtheCVEcorpusinstead—thattradesanauthoritativeanswerforaguess\.Step3—pickonefromthatset\.Everymemberalreadysatisfiestheweakness,soreadthecandidates’descriptionswith‘get\_entity‘andprefertheonethatalsomatchesthequestion’sextraspecifics\(affectedcomponent,attackconsequence,privilegerequired\)\.Withnothingtoseparatethem,answerthefirst\.RecencyandCVSSareNOTtiebreakers\.Ifstep1yieldsnoconvincingCWE,trythenextCWEcandidatefromthesearch\(therightsourceisusuallyinthetop3\)beforegivinguponthisroute\.Fallback—ONLYwhennoplausibleCWEexistsoritsreverseedgeisempty\(someCWEshavenolinkedCVE\)\.SearchtheCVEcorpusdirectly:\(1\)PathA:‘search\_kb\(kb="cve",query=<question\>\)‘withNOmust\_terms—notethetop\-5\.\(2\)PathB:pickthe2\-3mostspecifictechnicaltermsinthequestion\(componentnames,mechanismwordslike"hardwarerandom","sandbox",instruction/protocolnames—nevergenericwordslikesystem/attacker\),then‘search\_kb\(kb="cve",query=<question\>,must\_terms=\[t1,t2\]\)‘\.Iterateon‘n\_term\_matches\_in\_kb‘:\>30hits→\\rightarrowaddaterm;0hits→\\rightarrowdroptheweakesttermorswapasynonym\("randomness"→\\rightarrow"entropy"\);giveupafter3proberoundsandfallbacktoPathA’slist\.\(3\)Readeachcandidate’sdescriptionandtickoffEVERYspecificdetailofthequestion—mechanism,component,consequence\.PickthecandidatematchingALLdetails;ifnonematchesall,picktheonematchingthemechanism\(notthecomponent\)\.AnswerwithexactlyoneCVEidentifier,statedexplicitly,plusonesentenceofreasoninggroundedintheverifiedentry\.TheanswertothisquestionisaCVE:aCWEorCAPECidisanintermediatehop,nevertheanswer—iftheidyouareabouttosubmitdoesnotstartwith‘CVE\-‘,youstoppedearly,sogobacktoStep2andcontinue\.NEVERanswerempty\.

### H\.3Attribution to ATT&CK Techniques \(ATA\)

ATA and VCA share a decompose–restate–verify spine but differ in output cardinality and target taxonomy, so they ship separately\. Both encode the scoring geometry explicitly: under symmetric identifier F1 a spurious identifier costs exactly what a miss does, hence the rule that rejected candidates must not appear anywhere in the answer text\.

Skill Playbook:attribution\-ata\.md[⬇](data:text/plain;base64,IyBTa2lsbDogZ3JvdW5kaW5nIGEgcmVwb3J0IG5hcnJhdGl2ZSB0byBpdHMgQVRUJkNLIHRlY2huaXF1ZQoKVHJpZ2dlcjogYSBxdW90ZWQgYmxvZyBwYXNzYWdlIGRlc2NyaWJlcyBhdHRhY2tlciBiZWhhdmlvcjsgaWRlbnRpZnkgdGhlCkFUVCZDSyB0ZWNobmlxdWUgaXQgbWFwcyB0by4gKipUaGUgYW5zd2VyIGlzIGV4YWN0bHkgb25lIFQtaWQuKioKCkV2ZXJ5IHF1ZXN0aW9uIGhlcmUgaGFzIGEgc2luZ2xlIGdvbGQgdGVjaG5pcXVlLiBBIHNlY29uZCBwbGF1c2libGUgVC1pZApjYW5ub3QgZ2FpbiB5b3UgYW55dGhpbmcgYW5kIHN0cmljdGx5IGNvc3RzIHByZWNpc2lvbiwgc28gcGljayB0aGUgYmVzdCBvbmUKYW5kIGRyb3AgdGhlIHJ1bm5lci11cCAtLSBldmVuIHdoZW4gdHdvIGZlZWwgZXF1YWxseSBnb29kLiBBIHBhc3NhZ2Ugb2Z0ZW4KbmFycmF0ZXMgc2V2ZXJhbCBzdGVwcyAoZGVsaXZlcnksIGV4ZWN1dGlvbiwgZXZhc2lvbik7IHRoZSBxdWVzdGlvbiBhc2tzIGZvcgp0aGUgdGVjaG5pcXVlIGl0IGlzICphYm91dCosIHRoZSBvbmUgdGhlIHBhc3NhZ2Ugc3BlbmRzIGl0cyBkZXRhaWwgb24sIG5vdApldmVyeSBzdGVwIHlvdSBjYW4gbmFtZS4KClJlY29tbWVuZGVkIHNlcXVlbmNlOgoxLiAqKkRlY29tcG9zZSB0aGUgcGFzc2FnZSBpbnRvIGF0b21pYyBiZWhhdmlvcnMqKiAoZWFjaCBhIHNpbmdsZSBhY3Rpb25hYmxlCiAgIHNlY3VyaXR5IGV2ZW50KS4gUHJvc2UgaW50ZXJsZWF2ZXMgc2V2ZXJhbCBiZWhhdmlvcnM7IG9uZS10by1tYW55IGlzIGNvbW1vbi4KMi4gUGVyIGJlaGF2aW9yLCBgc2VhcmNoX2tiKGtiPSJtaXRyZSIsIHRvcF9rPTEwKWAg4oCUIHRoZSByaWdodCBlbnRyeSBvZnRlbiByYW5rcyA1LTEwLCBOT1QgdG9wLTMsIGJlY2F1c2UKICAgZmFtb3VzIHNpYmxpbmcgdGVjaG5pcXVlcyBvdXRyYW5rIHByZWNpc2Ugb25lcy4gUmVzdGF0ZSB0aGUgYmVoYXZpb3IgaW4KICAgdGhlIHRheG9ub215J3Mgb3duIGlkaW9tIOKAlCBBVFQmQ0sgbmFtZXMgYXJlICJQYXJlbnQ6IFN1Yi10ZWNobmlxdWUiIG5vdW4KICAgcGhyYXNlcyAoIlN1YnZlcnQgVHJ1c3QgQ29udHJvbHM6IE1hcmstb2YtdGhlLVdlYiBCeXBhc3MiKTsgQ1dFIG5hbWVzIGFyZQogICAiSW1wcm9wZXIvTWlzc2luZy9JbmNvcnJlY3QgWCIuIE5hcnJhdGl2ZSB2ZXJicyByYXJlbHkgbWF0Y2g6IGNhbm9uaWNhbGl6ZQogICBiZWZvcmUgc2VhcmNoaW5nLgogICBXaGVuIHlvdSBwaWNrIGEgcGFyZW50IHRlY2huaXF1ZSwgYWxzbyBjYWxsCiAgIGBvbnRvbG9neV9uZWlnaGJvcnMobm9kZV9pZD08VC1pZD4sIHJlbD0ic3ViX3RlY2huaXF1ZV9vZiIsCiAgIGRpcmVjdGlvbj0iaW4iKWAgYW5kIGNoZWNrIHdoZXRoZXIgYSBzdWItdGVjaG5pcXVlIG1hdGNoZXMgdGhlIHBhc3NhZ2UncwogICBzcGVjaWZpY3MgYmV0dGVyLgozLiAqKlZhbGlkYXRlIGVhY2ggY2FuZGlkYXRlKiogd2l0aCBgZ2V0X2VudGl0eWA6IHRoZSBlbnRyeSdzIGRlc2NyaXB0aW9uIG11c3QKICAgY292ZXIgdGhlIGRlc2NyaWJlZCBiZWhhdmlvciwgbm90IG1lcmVseSBzaGFyZSB3b3Jkcy4gUmVqZWN0IGNvLW9jY3VycmVuY2UKICAgbWF0Y2hlcy4gU3ViLXRlY2huaXF1ZSBiZWF0cyBwYXJlbnQgdGVjaG5pcXVlIHdoZW4gdGhlIGRldGFpbCBzdXBwb3J0cyBpdC4KNC4gSWYgdGhlIHBhc3NhZ2UgbmFtZXMgaWRlbnRpZmllcnMgKENWRS0uLi4pLCBgb250b2xvZ3lfbmVpZ2hib3JzYCBmcm9tIHRoZW0KICAgKGhhc193ZWFrbmVzcykgZ2l2ZXMgYXV0aG9yaXRhdGl2ZSBDV0UgYW5jaG9ycyBmb3IgZnJlZS4KNS4gQ29tbWl0IHRvIE9ORSB0ZWNobmlxdWUuIElmIHR3byBjYW5kaWRhdGVzIHN1cnZpdmUgdmVyaWZpY2F0aW9uLCBjaG9vc2Ugb24KICAgdGhlIHBhc3NhZ2UncyBvd24gd29yZGluZyByYXRoZXIgdGhhbiBsaXN0aW5nIGJvdGguIElmIG5vbmUgY29udmluY2luZ2x5CiAgIG1hdGNoZXMsIHJlLXNlYXJjaCB3aXRoIDItMyBhbHRlcm5hdGl2ZSBwaHJhc2luZ3MgYmVmb3JlIHNldHRsaW5nLgogICBBbnN3ZXIgYW55IHN1Yi1xdWVzdGlvbnMgKHBsYXRmb3JtcywgZGF0YSBzb3VyY2VzKSBmcm9tIHRoZSBgZ2V0X2VudGl0eWAKICAgYXR0cnMg4oCUIHRoZXkgYXJlIGF1dGhvcml0YXRpdmUgZmllbGRzLCBub3QgZ3Vlc3Nlcy4KCkRlY2lzaW9uIHBvaW50czoKLSBCZWhhdmlvciBtYXRjaGVzIGJvdGggcGFyZW50IGFuZCBzdWItdGVjaG5pcXVlIOKGkiBwcmVmZXIgdGhlIHN1Yi10ZWNobmlxdWUgaWYKICB0aGUgcGFzc2FnZSdzIHNwZWNpZmljcyB3YXJyYW50IGl0LCBlbHNlIHRoZSBwYXJlbnQuCi0gUHJlY2lzaW9uIG92ZXIgcmVjYWxsOiBhIHdyb25nIGV4dHJhIGlkZW50aWZpZXIgY29zdHMgZXhhY3RseSBhcyBtdWNoIGFzIGEKICBtaXNzLiBOZXZlciBwcmVzZW50ICJyZWxhdGVkIiBvciAiYWRkaXRpb25hbGx5IHJlbGV2YW50IiBpZGVudGlmaWVycy4KLSBDUklUSUNBTCBPVVRQVVQgUlVMRTogZXZlcnkgQ1dFLS9ULSBpZGVudGlmaWVyIHRva2VuIGFwcGVhcmluZyBBTllXSEVSRSBpbgogIHlvdXIgZmluYWwgYW5zd2VyIGlzIHNjb3JlZCBhcyBvbmUgb2YgeW91ciBwcmVkaWN0aW9ucy4gTWVudGlvbiBPTkxZIHlvdXIKICBjaG9zZW4gaWRlbnRpZmllcjsgbmV2ZXIgbmFtZSByZWplY3RlZCBjYW5kaWRhdGVzLCBjb21wYXJpc29ucywgb3IKICBhbHRlcm5hdGl2ZXMgaW4gdGhlIGFuc3dlciB0ZXh0LiBFeGFjdGx5IG9uZSBULWlkIG1heSBhcHBlYXIgYW55d2hlcmUgaW4KICB0aGUgYW5zd2VyLg==)\#Skill:groundingareportnarrativetoitsATT&CKtechniqueTrigger:aquotedblogpassagedescribesattackerbehavior;identifytheATT&CKtechniqueitmapsto\.\*\*TheanswerisexactlyoneT\-id\.\*\*Everyquestionherehasasinglegoldtechnique\.AsecondplausibleT\-idcannotgainyouanythingandstrictlycostsprecision,sopickthebestoneanddroptherunner\-up\-\-evenwhentwofeelequallygood\.Apassageoftennarratesseveralsteps\(delivery,execution,evasion\);thequestionasksforthetechniqueitis\*about\*,theonethepassagespendsitsdetailon,noteverystepyoucanname\.Recommendedsequence:1\.\*\*Decomposethepassageintoatomicbehaviors\*\*\(eachasingleactionablesecurityevent\)\.Proseinterleavesseveralbehaviors;one\-to\-manyiscommon\.2\.Perbehavior,‘search\_kb\(kb="mitre",top\_k=10\)‘—therightentryoftenranks5\-10,NOTtop\-3,becausefamoussiblingtechniquesoutrankpreciseones\.Restatethebehaviorinthetaxonomy’sownidiom—ATT&CKnamesare"Parent:Sub\-technique"nounphrases\("SubvertTrustControls:Mark\-of\-the\-WebBypass"\);CWEnamesare"Improper/Missing/IncorrectX"\.Narrativeverbsrarelymatch:canonicalizebeforesearching\.Whenyoupickaparenttechnique,alsocall‘ontology\_neighbors\(node\_id=<T\-id\>,rel="sub\_technique\_of",direction="in"\)‘andcheckwhetherasub\-techniquematchesthepassage’sspecificsbetter\.3\.\*\*Validateeachcandidate\*\*with‘get\_entity‘:theentry’sdescriptionmustcoverthedescribedbehavior,notmerelysharewords\.Rejectco\-occurrencematches\.Sub\-techniquebeatsparenttechniquewhenthedetailsupportsit\.4\.Ifthepassagenamesidentifiers\(CVE\-\.\.\.\),‘ontology\_neighbors‘fromthem\(has\_weakness\)givesauthoritativeCWEanchorsforfree\.5\.CommittoONEtechnique\.Iftwocandidatessurviveverification,chooseonthepassage’sownwordingratherthanlistingboth\.Ifnoneconvincinglymatches,re\-searchwith2\-3alternativephrasingsbeforesettling\.Answeranysub\-questions\(platforms,datasources\)fromthe‘get\_entity‘attrs—theyareauthoritativefields,notguesses\.Decisionpoints:\-Behaviormatchesbothparentandsub\-technique→\\rightarrowpreferthesub\-techniqueifthepassage’sspecificswarrantit,elsetheparent\.\-Precisionoverrecall:awrongextraidentifiercostsexactlyasmuchasamiss\.Neverpresent"related"or"additionallyrelevant"identifiers\.\-CRITICALOUTPUTRULE:everyCWE\-/T\-identifiertokenappearingANYWHEREinyourfinalanswerisscoredasoneofyourpredictions\.MentionONLYyourchosenidentifier;nevernamerejectedcandidates,comparisons,oralternativesintheanswertext\.ExactlyoneT\-idmayappearanywhereintheanswer\.

### H\.4Attribution to CWE Weaknesses \(VCA\)

Skill Playbook:attribution\-vca\.md[⬇](data:text/plain;base64,IyBTa2lsbDogZ3JvdW5kaW5nIGEgdnVsbmVyYWJpbGl0eSBuYXJyYXRpdmUgdG8gaXRzIENXRQoKVHJpZ2dlcjogYSBxdW90ZWQgYmxvZyBwYXNzYWdlIGRlc2NyaWJlcyBhIHZ1bG5lcmFiaWxpdHkgb3IgZXhwbG9pdGF0aW9uCm5hcnJhdGl2ZTsgaWRlbnRpZnkgdGhlIENXRSB3ZWFrbmVzcyBpdCBtYXBzIHRvLiAqKlRoZSBhbnN3ZXIgaXMgYWx3YXlzIGEgQ1dFLioqCgpBIHBhc3NhZ2UgYWJvdXQgYXR0YWNrZXIgYmVoYXZpb3Igd2lsbCBhbHdheXMgc3VnZ2VzdCBwbGF1c2libGUgQVRUJkNLCnRlY2huaXF1ZXMgdG9vIOKAlCBpZ25vcmUgdGhlbS4gU2VhcmNoIGBrYj0iY3dlImAgb25seSwgYW5kIGVtaXQgb25seSBgQ1dFLW5ubmAKaWRlbnRpZmllcnMuIEEgVC1pZCBpbiB0aGUgYW5zd2VyIGlzIG5vdCBhIHBhcnRpYWwgY3JlZGl0LCBpdCBpcyBhIHdyb25nCnByZWRpY3Rpb24uIElmIHRoZSBwYXNzYWdlIGZlZWxzIHRvbyB0aGluIHRvIGdyb3VuZCBhIENXRSBjb25maWRlbnRseSwgc3RpbGwKY29tbWl0IHRvIHRoZSBiZXN0LXN1cHBvcnRlZCBvbmU6IGFic3RhaW5pbmcgYW5kIGFuc3dlcmluZyB3cm9uZ2x5IHNjb3JlIHRoZQpzYW1lLCBzbyBhIGNhbGlicmF0ZWQgYW5zd2VyIHN0cmljdGx5IGRvbWluYXRlcy4KCklmIHRoZSBxdWVzdGlvbiB0cnVuY2F0ZXMgbWlkLXNlbnRlbmNlIChlLmcuIGVuZHMgYXQgIlBsZWFzZSBwcm92aWRlOiAxKSIpLAphbnN3ZXIgd2l0aCB0aGUgc2luZ2xlIENXRSBpZGVudGlmaWVyIHBsdXMgb25lIHNlbnRlbmNlIG9mIGp1c3RpZmljYXRpb24uCgpSZWNvbW1lbmRlZCBzZXF1ZW5jZToKMS4gKipEZWNvbXBvc2UgdGhlIHBhc3NhZ2UgaW50byBhdG9taWMgYmVoYXZpb3JzKiogKGVhY2ggYSBzaW5nbGUgYWN0aW9uYWJsZQogICBzZWN1cml0eSBldmVudCkuIFByb3NlIGludGVybGVhdmVzIHNldmVyYWwgYmVoYXZpb3JzOyBvbmUtdG8tbWFueSBpcyBjb21tb24uCjIuIFBlciBiZWhhdmlvciwgYHNlYXJjaF9rYihrYj0iY3dlIiwgdG9wX2s9MTApYCDigJQgdGhlIHJpZ2h0IGVudHJ5IG9mdGVuCiAgIHJhbmtzIDUtMTAsIE5PVCB0b3AtMywgYmVjYXVzZSBmYW1vdXMgc2libGluZyB3ZWFrbmVzc2VzIG91dHJhbmsgcHJlY2lzZQogICBvbmVzLiBSZXN0YXRlIHRoZSBiZWhhdmlvciBpbiBDV0UncyBvd24gaWRpb206IGVudHJpZXMgYXJlIG5hbWVkCiAgICJJbXByb3Blci9NaXNzaW5nL0luY29ycmVjdCBYIi4gTmFycmF0aXZlIHZlcmJzIHJhcmVseSBtYXRjaDogY2Fub25pY2FsaXplCiAgIGJlZm9yZSBzZWFyY2hpbmcuCjMuICoqVmFsaWRhdGUgZWFjaCBjYW5kaWRhdGUqKiB3aXRoIGBnZXRfZW50aXR5YDogdGhlIGVudHJ5J3MgZGVzY3JpcHRpb24gbXVzdAogICBjb3ZlciB0aGUgZGVzY3JpYmVkIGJlaGF2aW9yLCBub3QgbWVyZWx5IHNoYXJlIHdvcmRzLiBSZWplY3QgY28tb2NjdXJyZW5jZQogICBtYXRjaGVzLgo0LiBJZiB0aGUgcGFzc2FnZSBuYW1lcyBpZGVudGlmaWVycyAoQ1ZFLS4uLiksIGBvbnRvbG9neV9uZWlnaGJvcnNgIGZyb20gdGhlbQogICAoaGFzX3dlYWtuZXNzKSBnaXZlcyBhdXRob3JpdGF0aXZlIENXRSBhbmNob3JzIGZvciBmcmVlLgo1LiBDb25zb2xpZGF0ZSB0byBhIENBTElCUkFURUQgc2V0OiBvdXRwdXQgdGhlIHNtYWxsZXN0IHNldCBvZiBpZGVudGlmaWVycwogICB0aGF0IGNvdmVycyBldmVyeSBkZXNjcmliZWQgYmVoYXZpb3IuIE9uZSBiZWhhdmlvciAtPiB1c3VhbGx5IG9uZSBpZGVudGlmaWVyOwogICBidXQgd2hlbiB0d28gY2FuZGlkYXRlcyBCT1RIIHBsYXVzaWJseSBtYXRjaCBhIGJlaGF2aW9yIGFmdGVyIHZlcmlmaWNhdGlvbgogICBhbmQgeW91IGNhbm5vdCBzZXBhcmF0ZSB0aGVtIG9uIHRoZSBlbnRyeSB0ZXh0LCBpbmNsdWRlIGJvdGguIERvIG5vdCBpbmNsdWRlCiAgIGEgdGhpcmQuIElmIE5PIGNhbmRpZGF0ZSBjb252aW5jaW5nbHkgbWF0Y2hlcyBhIGJlaGF2aW9yLCByZS1zZWFyY2ggd2l0aAogICAyLTMgYWx0ZXJuYXRpdmUgcGhyYXNpbmdzIChkaWZmZXJlbnQgaWRpb20sIGRpZmZlcmVudCBhc3BlY3Qgb2YgdGhlCiAgIGJlaGF2aW9yKSBiZWZvcmUgc2V0dGxpbmcuCiAgIEFuc3dlciBhbnkgc3ViLXF1ZXN0aW9ucyAocGxhdGZvcm1zLCBkYXRhIHNvdXJjZXMpIGZyb20gdGhlIGBnZXRfZW50aXR5YAogICBhdHRycyDigJQgdGhleSBhcmUgYXV0aG9yaXRhdGl2ZSBmaWVsZHMsIG5vdCBndWVzc2VzLgoKRGVjaXNpb24gcG9pbnRzOgotIFRoZSBnb2xkIGFuc3dlciBpcyB1c3VhbGx5IHRoZSB3ZWFrbmVzcyBDTEFTUyB0aGUgcGFzc2FnZSBpbGx1c3RyYXRlcywgbm90CiAgdGhlIG5hcnJvd2VzdCB2YXJpYW50IHlvdSBjYW4gZmluZC4gV2hlbiBhIHNwZWNpZmljIENXRSBhbmQgaXRzIG1vcmUgZ2VuZXJhbAogIHBhcmVudCBib3RoIGZpdCwgcHJlZmVyIHRoZSBvbmUgdGhlIHBhc3NhZ2UncyBvd24gd29yZGluZyBzdXBwb3J0czsgZG8gbm90CiAgcmVhY2ggZm9yIGEgbmFycm93ZXIgdmFyaWFudCBvbiBkZXRhaWwgdGhlIHBhc3NhZ2UgbmV2ZXIgc3RhdGVzLgotIFByZWNpc2lvbiBvdmVyIHJlY2FsbDogYSB3cm9uZyBleHRyYSBpZGVudGlmaWVyIGNvc3RzIGV4YWN0bHkgYXMgbXVjaCBhcyBhCiAgbWlzcy4gTmV2ZXIgcHJlc2VudCAicmVsYXRlZCIgb3IgImFkZGl0aW9uYWxseSByZWxldmFudCIgaWRlbnRpZmllcnMuCi0gQ1JJVElDQUwgT1VUUFVUIFJVTEU6IGV2ZXJ5IENXRS0vVC0gaWRlbnRpZmllciB0b2tlbiBhcHBlYXJpbmcgQU5ZV0hFUkUgaW4KICB5b3VyIGZpbmFsIGFuc3dlciBpcyBzY29yZWQgYXMgb25lIG9mIHlvdXIgcHJlZGljdGlvbnMuIE1lbnRpb24gT05MWSB5b3VyCiAgY2hvc2VuIGlkZW50aWZpZXIocyk7IG5ldmVyIG5hbWUgcmVqZWN0ZWQgY2FuZGlkYXRlcywgY29tcGFyaXNvbnMsIG9yCiAgYWx0ZXJuYXRpdmVzIGluIHRoZSBhbnN3ZXIgdGV4dC4gQmVmb3JlIHN1Ym1pdHRpbmcsIGRlbGV0ZSBldmVyeSBULWlkIGZyb20KICB0aGUgYW5zd2VyIHRleHQg4oCUIGluY2x1ZGluZyBvbmVzIGNpdGVkIG9ubHkgYXMgc3VwcG9ydGluZyBjb250ZXh0Lg==)\#Skill:groundingavulnerabilitynarrativetoitsCWETrigger:aquotedblogpassagedescribesavulnerabilityorexploitationnarrative;identifytheCWEweaknessitmapsto\.\*\*TheanswerisalwaysaCWE\.\*\*ApassageaboutattackerbehaviorwillalwayssuggestplausibleATT&CKtechniquestoo—ignorethem\.Search‘kb="cwe"‘only,andemitonly‘CWE\-nnn‘identifiers\.AT\-idintheanswerisnotapartialcredit,itisawrongprediction\.IfthepassagefeelstoothintogroundaCWEconfidently,stillcommittothebest\-supportedone:abstainingandansweringwronglyscorethesame,soacalibratedanswerstrictlydominates\.Ifthequestiontruncatesmid\-sentence\(e\.g\.endsat"Pleaseprovide:1\)"\),answerwiththesingleCWEidentifierplusonesentenceofjustification\.Recommendedsequence:1\.\*\*Decomposethepassageintoatomicbehaviors\*\*\(eachasingleactionablesecurityevent\)\.Proseinterleavesseveralbehaviors;one\-to\-manyiscommon\.2\.Perbehavior,‘search\_kb\(kb="cwe",top\_k=10\)‘—therightentryoftenranks5\-10,NOTtop\-3,becausefamoussiblingweaknessesoutrankpreciseones\.RestatethebehaviorinCWE’sownidiom:entriesarenamed"Improper/Missing/IncorrectX"\.Narrativeverbsrarelymatch:canonicalizebeforesearching\.3\.\*\*Validateeachcandidate\*\*with‘get\_entity‘:theentry’sdescriptionmustcoverthedescribedbehavior,notmerelysharewords\.Rejectco\-occurrencematches\.4\.Ifthepassagenamesidentifiers\(CVE\-\.\.\.\),‘ontology\_neighbors‘fromthem\(has\_weakness\)givesauthoritativeCWEanchorsforfree\.5\.ConsolidatetoaCALIBRATEDset:outputthesmallestsetofidentifiersthatcoverseverydescribedbehavior\.Onebehavior\-\>usuallyoneidentifier;butwhentwocandidatesBOTHplausiblymatchabehaviorafterverificationandyoucannotseparatethemontheentrytext,includeboth\.Donotincludeathird\.IfNOcandidateconvincinglymatchesabehavior,re\-searchwith2\-3alternativephrasings\(differentidiom,differentaspectofthebehavior\)beforesettling\.Answeranysub\-questions\(platforms,datasources\)fromthe‘get\_entity‘attrs—theyareauthoritativefields,notguesses\.Decisionpoints:\-ThegoldanswerisusuallytheweaknessCLASSthepassageillustrates,notthenarrowestvariantyoucanfind\.WhenaspecificCWEanditsmoregeneralparentbothfit,prefertheonethepassage’sownwordingsupports;donotreachforanarrowervariantondetailthepassageneverstates\.\-Precisionoverrecall:awrongextraidentifiercostsexactlyasmuchasamiss\.Neverpresent"related"or"additionallyrelevant"identifiers\.\-CRITICALOUTPUTRULE:everyCWE\-/T\-identifiertokenappearingANYWHEREinyourfinalanswerisscoredasoneofyourpredictions\.MentionONLYyourchosenidentifier\(s\);nevernamerejectedcandidates,comparisons,oralternativesintheanswertext\.Beforesubmitting,deleteeveryT\-idfromtheanswertext—includingonescitedonlyassupportingcontext\.

### H\.5Multi\-Document Synthesis \(CSC, TAP, MLA\)

One playbook serves all three MDS subtasks\. It is the only skill whose prescriptions are mostly about*coverage*rather than routing, which matches the per\-tool profile of Figure[2\(b\)](https://arxiv.org/html/2608.18613#S4.F2.sf2): the MDS agent leans onread\_reportand the entity index and never touches the ontology tools\.

Skill Playbook:synthesis\.md[⬇](data:text/plain;base64,IyBTa2lsbDogbXVsdGktcmVwb3J0IHN5bnRoZXNpcyAoYWN0b3IgcHJvZmlsZXMsIG1hbHdhcmUgbGluZWFnZSwgY2FtcGFpZ24gdGltZWxpbmVzKQoKVHJpZ2dlcjogYSBxdWVzdGlvbiBhYm91dCBvbmUgdGhyZWF0IGVudGl0eSB3aG9zZSBpbnRlbGxpZ2VuY2UgaXMgc2NhdHRlcmVkCmFjcm9zcyBzZXZlcmFsIHZlbmRvciByZXBvcnRzIOKAlCBwb3NzaWJseSB1bmRlciBkaWZmZXJlbnQgbmFtZXMuCgpSZWNvbW1lbmRlZCBzZXF1ZW5jZToKMS4gKipDb3ZlciB0aGUgbGlzdGVkIGNsdXN0ZXIgZmlyc3QqKjogaWYgdGhlIHF1ZXN0aW9uIGxpc3RzIGEgcmVwb3J0CiAgIGNsdXN0ZXIgKGlkcyBsaWtlIFtCTE9HLW5dKSwgZmV0Y2ggRVZFUlkgbGlzdGVkIHJlcG9ydCB1cCBmcm9udCDigJQKICAgYHJlYWRfcmVwb3J0YCBvbiBlYWNoIGlkIChiYXNoIGFybTogY2F0IHJlcG9ydHMvPGlkPi50eHQpLiBUaGVzZSByZXBvcnRzCiAgIEFSRSB0aGUgcXVlc3Rpb24ncyBzY29wZTsgZG8gbm90IHNraXAgYW55IG9mIHRoZW0uCjIuICoqUmVzb2x2ZSB0aGUgYW5jaG9yIGVudGl0eSoqOiBgcmVzb2x2ZV9lbnRpdHlgIG9uIHRoZSBlbnRpdHkgbmFtZWQgaW4gdGhlCiAgIHF1ZXN0aW9uIChvciBzdXJmYWNlIGl0IHZpYSBgc2VhcmNoX2NodW5rc2AgZmlyc3QgaWYgb25seSBiZWhhdmlvciBpcwogICBnaXZlbikuIFRoZSByZXN1bHQgbGlzdHMgdGhlIGJ1aWxkLWFnZ3JlZ2F0ZWQgY3Jvc3MtdmVuZG9yIGBhbGlhc2VzYCBhbmQKICAgYG5fZG9jc2Ag4oCUIGZvciBhbGlhcy9uYW1pbmcgcXVlc3Rpb25zLCB0aGF0IGFsaWFzZXMgZmllbGQgaXMgdGhlIGNvbXBsZXRlCiAgIGF1dGhvcml0YXRpdmUgc2V0LgozLiAqKkNvbGxlY3QgYWRkaXRpb25hbCBjb250ZW50IHRocm91Z2ggdGhlIGVudGl0eSBpbmRleCoqOgogICBgY2h1bmtzX21lbnRpb25pbmdgIG9uIHRoZSByZXNvbHZlZCBlbnRpdHkgaWQgbGlzdHMgZXZlcnkgcmVwb3J0IHdoZXJlCiAgIGFueSBhbGlhcyBhcHBlYXJzIChkb2NfaWQsIHZlbmRvciwgZXhjZXJwdCkg4oCUIGByZWFkX3JlcG9ydGAgYW55IGxpc3RlZAogICByZXBvcnQgbm90IHlldCByZWFkLiBBbHNvIGByZXNvbHZlX2VudGl0eWAgb24gcmVsYXRlZCBuYW1lcyBmb3VuZCBhbG9uZwogICB0aGUgd2F5ICh2YXJpYW50cywgcHJlZGVjZXNzb3IgZmFtaWxpZXMpLiBTdGF5IG9uIHRoZSBjYW1wYWlnbiB0aGUKICAgcXVlc3Rpb24gaXMgYWJvdXQ6IGRyb3AgcmVwb3J0cyB0aGF0IG1lcmVseSBzaGFyZSBhbiBhY3RvciBuYW1lIGJ1dAogICBkZXNjcmliZSBhIGRpZmZlcmVudCBjYW1wYWlnbi4KNC4gKipQZXItcmVwb3J0IGNoZWNrbGlzdCBleHRyYWN0aW9uKiogKGRvIE5PVCBzdW1tYXJpemUgdGhlIHBpbGUgaW4gb25lCiAgIHBhc3MpOiBmaXJzdCBsaXN0IHRoZSBkaXN0aW5jdCByZXBvcnRzIHlvdSByZXRyaWV2ZWQ7IHRoZW4gZm9yIEVBQ0gKICAgcmVwb3J0LCBnbyB0aHJvdWdoIEVWRVJZIGZpZWxkIG9mIHRoZSByZXF1aXJlZCBhbnN3ZXIgZm9ybWF0IGFuZCBub3RlIHdoYXQKICAgdGhhdCByZXBvcnQgY29udHJpYnV0ZXMgKG5hbWVzLCBkYXRlcywgY2FwYWJpbGl0aWVzLCB0YXJnZXRzKS4KICAgYHJlYWRfcmVwb3J0YCBzdGFydHMgd2l0aCB0aGUgcmVwb3J0J3MgYnVpbGQtZXh0cmFjdGVkCiAgIGBpbmRleGVkX2VudGl0aWVzYC9gaW5kZXhlZF90dHBzYCDigJQgYSBoYW5keSBmbG9vciBmb3Igd2hhdCB0aGUgcmVwb3J0CiAgIG1lbnRpb25zICh0eXBlIGJ1Y2tldHMgYXJlIGhldXJpc3RpYykg4oCUIHRoZW4gcmVhZCB0aGUgZnVsbCB0ZXh0OiBmYWN0cwogICBvZnRlbiBzaXQgaW4gcGFzc2FnZXMgdGhhdCBkbyBub3QgbmFtZSB0aGUgYW5jaG9yIGVudGl0eS4KNS4gKipNZXJnZSBhY3Jvc3MgcmVwb3J0cy92ZW5kb3JzKio6IHVuaW9uIHRoZSBwZXItcmVwb3J0IG5vdGVzIGZpZWxkIGJ5CiAgIGZpZWxkOyBncm91cCBieSB2ZW5kb3IgZm9yIGNvcnJvYm9yYXRpb24uIEZvciBkYXRlcyBhbmQgdGltZWxpbmVzLCB1c2UKICAgb25seSBkYXRlcyBzdGF0ZWQgaW4gdGhlIHJlcG9ydCBURVhUIChhY3Rpdml0eSBkYXRlcywgZGlzY2xvc3VyZSBkYXRlcyBpbgogICBwcm9zZSkg4oCUIG1ldGFkYXRhIGlzIG5vdCBwcm92aWRlZC4gQ29weSBkYXRlIHF1YWxpZmllcnMgdmVyYmF0aW0KICAgKCJsYXRlIDIwMjEiLCAiZWFybHkgMjAyNCIsICJBcHJpbCAyMywgMjAyNSIpIOKAlCBkbyBub3Qgcm91bmQgb3IgcmV3b3JkLgo2LiAqKlN5bnRoZXNpemUgd2l0aCBleHBsaWNpdCBhbGlhcyByZXNvbHV0aW9uKio6IG5hbWUgdGhlIGNhbm9uaWNhbCBlbnRpdHksCiAgIGxpc3QgdGhlIGFsaWFzZXMgYW5kIHdoaWNoIHZlbmRvciB1c2VzIHdoaWNoLCBvcmRlciBldmVudHMgYnkgdGhlIGRhdGVzCiAgIHN0YXRlZCBpbiB0aGUgdGV4dCwgYXR0cmlidXRlIGNsYWltcyB0byB2ZW5kb3JzLiBOb3RlIGRpc2FncmVlbWVudHMKICAgcmF0aGVyIHRoYW4gYXZlcmFnaW5nIHRoZW0uCjcuICoqQW5zd2VyIGZvcm0qKjogY29tcGFjdCBidWxsZXRzIGFuc3dlcmluZyBFWEFDVExZIHRoZSBhc3BlY3RzIGFza2VkCiAgIChlLmcuICJjYW5vbmljYWwgbmFtZSAvIGFsaWFzZXMgcmVzb2x2ZWQiIG9yICJkYXRlcyAvIHBoYXNlcyIpLiBFdmVyeQogICBidWxsZXQgbXVzdCBiZSBhIGNsYWltIGdyb3VuZGVkIGluIGEgcmV0cmlldmVkIGNodW5rLiBObyBiYWNrZ3JvdW5kCiAgIGZpbGxlciwgbm8gc3BlY3VsYXRpb24sIG5vICJhZGRpdGlvbmFsbHkiIHBhZGRpbmcg4oCUIGV4dHJhIHVuc3VwcG9ydGVkCiAgIGNsYWltcyBkaXJlY3RseSBsb3dlciB5b3VyIHNjb3JlLgoKRGVjaXNpb24gcG9pbnRzOgotICJBbGwgLyBldmVyeSAvIGRpc3RpbmN0IFggYWNyb3NzIHRoZXNlIHJlcG9ydHMiIOKGkiBjb2xsZWN0IGNhbmRpZGF0ZXMgZnJvbQogIEVWRVJZIHJlcG9ydCByZWFkIChub3Qgb25seSB0aG9zZSBsaW5rZWQgdG8gdGhlIGFuY2hvciBlbnRpdHkpLCBkZWR1cGUgYnkKICBjYW5vbmljYWwgbmFtZSwgbGlzdCB0aGUgd2hvbGUgc2V0LgotIFRpbWVsaW5lIHF1ZXN0aW9ucyDihpIgY29sbGVjdCBkYXRlIHN0YXRlbWVudHMgZnJvbSB0aGUgY2h1bmsgdGV4dHM7CiAgZmlyc3Qtc2VlbiBjbGFpbXMgbmVlZCB0aGUgZWFybGllc3Qgc3RhdGVkIGRhdGUsIG5vdCB0aGUgbW9zdCBkZXRhaWxlZCByZXBvcnQuCi0gTGluZWFnZSBxdWVzdGlvbnMg4oaSIHJlc29sdmUgZWFjaCB2YXJpYW50IGVudGl0eSwgcmVhZCB0aGUgY2h1bmsgaW50cm9kdWNpbmcKICBpdCBmb3IgdGhlIGNhcGFiaWxpdHkgZGVsdGEuCi0gVGFyZ2V0aW5nL2NvcnJvYm9yYXRpb24gcXVlc3Rpb25zIOKGkiBncm91cCB0aGUgY2h1bmtzIGJ5IHZlbmRvcjsgYSBjbGFpbQogIGJhY2tlZCBieSBtdWx0aXBsZSB2ZW5kb3JzIGlzIHN0cm9uZ2VyIHRoYW4gYSBzaW5nbGUtc291cmNlIG9uZS4=)\#Skill:multi\-reportsynthesis\(actorprofiles,malwarelineage,campaigntimelines\)Trigger:aquestionaboutonethreatentitywhoseintelligenceisscatteredacrossseveralvendorreports—possiblyunderdifferentnames\.Recommendedsequence:1\.\*\*Coverthelistedclusterfirst\*\*:ifthequestionlistsareportcluster\(idslike\[BLOG\-n\]\),fetchEVERYlistedreportupfront—‘read\_report‘oneachid\(basharm:catreports/<id\>\.txt\)\.ThesereportsAREthequestion’sscope;donotskipanyofthem\.2\.\*\*Resolvetheanchorentity\*\*:‘resolve\_entity‘ontheentitynamedinthequestion\(orsurfaceitvia‘search\_chunks‘firstifonlybehaviorisgiven\)\.Theresultliststhebuild\-aggregatedcross\-vendor‘aliases‘and‘n\_docs‘—foralias/namingquestions,thataliasesfieldisthecompleteauthoritativeset\.3\.\*\*Collectadditionalcontentthroughtheentityindex\*\*:‘chunks\_mentioning‘ontheresolvedentityidlistseveryreportwhereanyaliasappears\(doc\_id,vendor,excerpt\)—‘read\_report‘anylistedreportnotyetread\.Also‘resolve\_entity‘onrelatednamesfoundalongtheway\(variants,predecessorfamilies\)\.Stayonthecampaignthequestionisabout:dropreportsthatmerelyshareanactornamebutdescribeadifferentcampaign\.4\.\*\*Per\-reportchecklistextraction\*\*\(doNOTsummarizethepileinonepass\):firstlistthedistinctreportsyouretrieved;thenforEACHreport,gothroughEVERYfieldoftherequiredanswerformatandnotewhatthatreportcontributes\(names,dates,capabilities,targets\)\.‘read\_report‘startswiththereport’sbuild\-extracted‘indexed\_entities‘/‘indexed\_ttps‘—ahandyfloorforwhatthereportmentions\(typebucketsareheuristic\)—thenreadthefulltext:factsoftensitinpassagesthatdonotnametheanchorentity\.5\.\*\*Mergeacrossreports/vendors\*\*:uniontheper\-reportnotesfieldbyfield;groupbyvendorforcorroboration\.Fordatesandtimelines,useonlydatesstatedinthereportTEXT\(activitydates,disclosuredatesinprose\)—metadataisnotprovided\.Copydatequalifiersverbatim\("late2021","early2024","April23,2025"\)—donotroundorreword\.6\.\*\*Synthesizewithexplicitaliasresolution\*\*:namethecanonicalentity,listthealiasesandwhichvendoruseswhich,ordereventsbythedatesstatedinthetext,attributeclaimstovendors\.Notedisagreementsratherthanaveragingthem\.7\.\*\*Answerform\*\*:compactbulletsansweringEXACTLYtheaspectsasked\(e\.g\."canonicalname/aliasesresolved"or"dates/phases"\)\.Everybulletmustbeaclaimgroundedinaretrievedchunk\.Nobackgroundfiller,nospeculation,no"additionally"padding—extraunsupportedclaimsdirectlyloweryourscore\.Decisionpoints:\-"All/every/distinctXacrossthesereports"→\\rightarrowcollectcandidatesfromEVERYreportread\(notonlythoselinkedtotheanchorentity\),dedupebycanonicalname,listthewholeset\.\-Timelinequestions→\\rightarrowcollectdatestatementsfromthechunktexts;first\-seenclaimsneedtheearlieststateddate,notthemostdetailedreport\.\-Lineagequestions→\\rightarrowresolveeachvariantentity,readthechunkintroducingitforthecapabilitydelta\.\-Targeting/corroborationquestions→\\rightarrowgroupthechunksbyvendor;aclaimbackedbymultiplevendorsisstrongerthanasingle\-sourceone\.