Metraipolis › archive › dc_3d968ccdd85d

Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language Model — arXiv:2609.26316

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.26316
License (as archived): CC0-1.0
Archived: 2026-10-08T14:42:12.027Z
SHA-256 of the archived text: 742738727f07ed939610c07e29d152d837cba620dc28116c024bfea56331b1b5
Stable URL of this page: https://metraipolis.com/documento/dc_3d968ccdd85d

How to cite

Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language Model — arXiv:2609.26316 — arXiv (en), https://arxiv.org/abs/2609.26316 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_3d968ccdd85d (Metraipolis archive dc_3d968ccdd85d, sha256 742738727f07ed939610c07e29d152d837cba620dc28116c024bfea56331b1b5)

BibTeX

@misc{dc3d968ccdd85d,
  title = {Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language Model — arXiv:2609.26316},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.26316},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_3d968ccdd85d; sha256 742738727f07ed939610c07e29d152d837cba620dc28116c024bfea56331b1b5},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.26316. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

This paper presents a controlled post-alert incident orchestration and response subsystem for educational information systems. The architecture separates deterministic classification, contextual analysis, human approval, and technical execution. A Rule Engine determines severity and selects the playbook, while Static RAG and a local large language model provide advisory content under Validator, Guardrail, Output Sanitizer, and Safe Fallback controls. Experiments begin after simulated alerts are stored in Elasticsearch. The Rule Engine matched the predefined routing matrix in all 30 boundary cases. The Durable Queue completed 100 events without duplicate tasks, new failed tasks, or unintended firewall rules. An eight-alert contention experiment preserved the configured limit of one active model request, and 30 sequential measurements showed an overall mean post-alert processing time of approximately 33 seconds. The results demonstrate functional correctness, traceability, controlled recovery, and bounded model integration within the evaluated laboratory scope.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-23 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Software Engineering (cs.SE).
Pagina del lavoro: https://arxiv.org/abs/2609.26316 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-08T13:55:11.756Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-23?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).