{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:UGDXGB5P5NU7MVEPUBXCN2CPXG","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"e38cbc6124ab788fdd3ce10c117afa15d14fef192e65b76a5892416570c7db09","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-21T05:58:04Z","title_canon_sha256":"380f6461d0fa0b23ae3ab147dd2bbb6928204ff556a88d466033dcd04c49f3b6"},"schema_version":"1.0","source":{"id":"2605.22027","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.22027","created_at":"2026-05-22T01:04:21Z"},{"alias_kind":"arxiv_version","alias_value":"2605.22027v1","created_at":"2026-05-22T01:04:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.22027","created_at":"2026-05-22T01:04:21Z"},{"alias_kind":"pith_short_12","alias_value":"UGDXGB5P5NU7","created_at":"2026-05-22T01:04:21Z"},{"alias_kind":"pith_short_16","alias_value":"UGDXGB5P5NU7MVEP","created_at":"2026-05-22T01:04:21Z"},{"alias_kind":"pith_short_8","alias_value":"UGDXGB5P","created_at":"2026-05-22T01:04:21Z"}],"graph_snapshots":[{"event_id":"sha256:5276cde8dd4eb0805e079e26b658b9e959de1c8d06c706072f79fffbbe0f856c","target":"graph","created_at":"2026-05-22T01:04:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2605.22027/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Security analysts routinely query system logs to detect threats and investigate incidents, but each log source uses its own semi-structured format: logs are cheap to produce, but expensive to use. The standard approach, building per-source parsers to normalize logs into structured schemas, is powerful but requires continuous engineering effort for each new format. Querying raw logs directly with tools like grep avoids this cost, but requires analysts to know each source's message variants and cannot express the multi-line temporal queries that security investigations demand. We present Sieve, ","authors_text":"David Wagner, Evan Luo, Julien Piet","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-21T05:58:04Z","title":"Parser-Free Querying of Security Logs"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.22027","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:8e689564a291f6562e9d11111486b7d4f58057b5766af8c4cad177b58923fb07","target":"record","created_at":"2026-05-22T01:04:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"e38cbc6124ab788fdd3ce10c117afa15d14fef192e65b76a5892416570c7db09","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-21T05:58:04Z","title_canon_sha256":"380f6461d0fa0b23ae3ab147dd2bbb6928204ff556a88d466033dcd04c49f3b6"},"schema_version":"1.0","source":{"id":"2605.22027","kind":"arxiv","version":1}},"canonical_sha256":"a1877307afeb69f6548fa06e26e84fb986e16d27d0216be16d30016f9b1110ce","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"a1877307afeb69f6548fa06e26e84fb986e16d27d0216be16d30016f9b1110ce","first_computed_at":"2026-05-22T01:04:21.095276Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-22T01:04:21.095276Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"d0Di2VMAKX6YzRHFZkFiSmnIAxS7AtCSsB0PdvZCeVpPQp/EmNDl+vcEX3pHdQI7xBaWTHUD7I2PxzJXjW/cDA==","signature_status":"signed_v1","signed_at":"2026-05-22T01:04:21.096016Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.22027","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:8e689564a291f6562e9d11111486b7d4f58057b5766af8c4cad177b58923fb07","sha256:5276cde8dd4eb0805e079e26b658b9e959de1c8d06c706072f79fffbbe0f856c"],"state_sha256":"ddfaba06e6dbc921fccc3e406661a900f9e0787b780b2b0bc19151791c78fd4e"}