# (EC)2: Event-Centric Explainability for Cybersecurity Through Multi-Agent LLM Investigations

arXiv: https://arxiv.org/abs/2607.26201 · HTML: https://mlsanity.com/paper/2607.26201/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 15 of its 35 references that are in the map.
- First posted on arXiv 28 Jul 2026.

## Builds on (most cited first, 15 of 15)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- ["Why Should I Trust You?": Explaining the Predictions of Any Classifier](https://mlsanity.com/paper/1602.04938/) (2016)
- [Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI](https://mlsanity.com/paper/1910.10045/) (2019)
- [Opportunities and Challenges in Explainable Artificial Intelligence (XAI): A Survey](https://mlsanity.com/paper/2006.11371/) (2020)
- [Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research](https://mlsanity.com/paper/2208.14937/) (2022)
- [HuntGPT: Integrating Machine Learning-Based Anomaly Detection and Explainable AI with Large Language Models (LLMs)](https://mlsanity.com/paper/2309.16021/) (2023)
- [Thinking Machines: A Survey of LLM based Reasoning Strategies](https://mlsanity.com/paper/2503.10814/) (2025)
- [Towards Explainable Network Intrusion Detection using Large Language Models](https://mlsanity.com/paper/2408.04342/) (2024)
- [ChatIDS: Advancing Explainable Cybersecurity Using Generative AI](https://mlsanity.com/paper/2306.14504/) (2023)
- [EXPLICATE: Enhancing Phishing Detection through Explainable AI and LLM-Powered Interpretability](https://mlsanity.com/paper/2503.20796/) (2025)
- [eX-NIDS: A Framework for Explainable Network Intrusion Detection Leveraging Large Language Models](https://mlsanity.com/paper/2507.16241/) (2025)
- [LLM-driven Provenance Forensics for Threat Investigation and Detection](https://mlsanity.com/paper/2508.21323/) (2025)
- [An Adaptive End-to-End IoT Security Framework Using Explainable AI and LLMs](https://mlsanity.com/paper/2409.13177/) (2024)
- [Interpretable Anomaly-Based DDoS Detection in AI-RAN with XAI and LLMs](https://mlsanity.com/paper/2507.21193/) (2025)
- [AnomalyExplainer Explainable AI for LLM-based anomaly detection using BERTViz and Captum](https://mlsanity.com/paper/2509.00069/) (2025)

## Abstract (arXiv)

Security operations centers rely on anomaly detection systems to flag suspicious events. Feature-level explanations for anomaly detectors offer limited value for operational investigations. To effectively handle alerts, analysts need to know contextual relationships and need actionable understanding of the entities involved. This paper introduces an event-centric detector-agnostic approach for explaining cybersecurity alerts in small- to medium-sized enterprise networks. We present (EC)2, a multi-agent framework that performs structured, hypothesis-driven investigation to provide explanations grounded in verifiable evidence. Evaluation results show that the proposed framework improves post-detection analysis by generating operationally meaningful explanations, which also enhance event classification accuracy.