Triple
T23312848
| Position | Surface form | Disambiguated ID | Type / Status |
|---|---|---|---|
| Subject | STIX |
E590627
|
entity |
| Predicate | hasComponent |
P35
|
FINISHED |
| Object | STIX Relationship Objects |
—
|
NE NERFINISHED |
How this triple was built (2 steps)
Every LLM step that produced this triple, in pipeline order — named-entity classification, the disambiguation choices (the exact options shown, with the pick highlighted), and the generated description. The batch + timestamp of each is in the Provenance table below.
NER
Named-entity recognition
gpt-5-mini
Instruction
Given a phrase, classify it is english named entity (e.g., persons, organizations, works of art) in Latin script, or not (e.g., literals, dates, URLs, verbose phrases). For disambiguation, the statement where the phrase occurs as object is also given. Please return a JSON object with `phrase` (string, the phrase being analyzed) and `is_ne` (boolean, indicating whether the phrase is a Named Entity).
Input
Phrase: STIX Relationship Objects | Statement: [STIX, hasComponent, STIX Relationship Objects]
NED1
Entity disambiguation (via context triple)
gpt-5-mini-2025-08-07
Target entity: STIX Relationship Objects Context triple: [STIX, hasComponent, STIX Relationship Objects]
-
A.
STIX
chosen
STIX is a structured language and data format used for representing, sharing, and analyzing cyber threat intelligence across organizations and tools.
-
B.
CyberGraphX
CyberGraphX is a graphics subsystem and API originally developed for Amiga systems, providing advanced graphics card support and hardware-accelerated rendering.
-
C.
TAXII
TAXII (Trusted Automated eXchange of Indicator Information) is a cybersecurity protocol that enables the automated, secure sharing of threat intelligence between organizations and systems.
-
D.
Splunk Phantom
Splunk Phantom is a security orchestration, automation, and response (SOAR) platform that helps security teams automate workflows, investigate threats, and respond to incidents more efficiently.
-
E.
CSAF
CSAF is the acronym for the highest-ranking officer and principal military advisor in the United States Air Force, the Chief of Staff of the Air Force.
- F. None of above.
- G. Unsure - the case is ambiguous/there is not enough information to decide.
Provenance (2 batches)
The batch behind each pipeline step, in order, with when it ran. Timestamps are batch-level — stages were processed in waves, so the object chain (NER → NED1 → NEDg → NED2) reads in order, but predicate / elicitation batches can sit in a different wave.
| Step | Stage | Batch ID | Status | When |
|---|---|---|---|---|
| creating | Elicitation | batch_69e25d1d32188190948eb76909d1dcc3 |
completed | April 17, 2026, 4:17 p.m. |
| NER | Named-entity recognition | batch_69f1972ca70481909e2415c65964210a |
completed | April 29, 2026, 5:29 a.m. |
Created at: April 17, 2026, 5:06 p.m.