APTInvestBench: Evaluating Autonomous APT Investigation under Varying Telemetry

Large language model LLM agents could help security operations centers SOCs investigate advanced persistent threats APTs by turning weak leads into evidence for intrusion scoping and response. Yet success under one telemetry setting does not establish robustness to changes in log collection,...