mlsanityData to 7 Oct 2026

(EC)2: Event-Centric Explainability for Cybersecurity Through Multi-Agent LLM Investigations

arXiv 2607.26201 ↗First posted 28 Jul 2026cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Security operations centers rely on anomaly detection systems to flag suspicious events. Feature-level explanations for anomaly detectors offer limited value for operational investigations. To effectively handle alerts, analysts need to know contextual relationships and need actionable understanding of the entities involved. This paper introduces an event-centric detector-agnostic approach for explaining cybersecurity alerts in small- to medium-sized enterprise networks. We present (EC)2, a multi-agent framework that performs structured, hypothesis-driven investigation to provide explanations grounded in verifiable evidence. Evaluation results show that the proposed framework improves post-detection analysis by generating operationally meaningful explanations, which also enhance event classification accuracy.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 15 of its 35 references that are in the map. First posted on arXiv 28 Jul 2026.

Builds on

15 of 35 references.

References · 15

  1. 2017A Unified Approach to Interpreting Model Predictionscited by 6,488
  2. 2016"Why Should I Trust You?": Explaining the Predictions of Any Classifiercited by 5,040
  3. 2019Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AIcited by 1,543
  4. 2020Opportunities and Challenges in Explainable Artificial Intelligence (XAI): A Surveycited by 252
  5. 2023HuntGPT: Integrating Machine Learning-Based Anomaly Detection and Explainable AI with Large Language Models (LLMs)cited by 25
  6. 2025Thinking Machines: A Survey of LLM based Reasoning Strategiescited by 25
  7. 2022Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Researchcited by 24
  8. 2023ChatIDS: Advancing Explainable Cybersecurity Using Generative AIcited by 12
  9. 2024Towards Explainable Network Intrusion Detection using Large Language Modelscited by 12
  10. 2025EXPLICATE: Enhancing Phishing Detection through Explainable AI and LLM-Powered Interpretabilitycited by 6
  11. 2025eX-NIDS: A Framework for Explainable Network Intrusion Detection Leveraging Large Language Modelscited by 5
  12. 2025LLM-driven Provenance Forensics for Threat Investigation and Detectioncited by 5
3 more
  1. 2024An Adaptive End-to-End IoT Security Framework Using Explainable AI and LLMscited by 2
  2. 2025Interpretable Anomaly-Based DDoS Detection in AI-RAN with XAI and LLMscited by 1
  3. 2025AnomalyExplainer Explainable AI for LLM-based anomaly detection using BERTViz and Captumcited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025CyberRAG: An Agentic RAG cyber attack classification and reporting tool
  2. 2026Towards Agentic Investigation of Security Alerts
  3. 2026CyTReX: Explainable AI-Based Cybersecurity Threat Reasoning Framework for DER Networks
  4. 2026AgenticTwin: An Agentic LLM Framework Integrated with Digital Twin for Anomaly Detection
  5. 2026From Investigation Failures to Reliable SOC Agents: Understanding and Improving LLM-Based Alert Triage
  6. 2025CORTEX: Collaborative LLM Agents for High-Stakes Alert Triage
  7. 2024Audit-LLM: Multi-Agent Collaboration for Log-based Insider Threat Detection
  8. 2026LiaisonAgent: An Multi-Agent Framework for Autonomous Risk Investigation and Governance