{
  "$schema": "https://themachinepress.com/schemas/story-v1.schema.json",
  "schema_version": "1.0.0",
  "document_type": "machine_press_story",
  "story": {
    "story_id": "mp-2026-08-14-007",
    "source_story_id": "tmp-story-graphrag-threat-intelligence",
    "edition_id": "mp-2026-08-14-morning-0036",
    "edition_url": "https://themachinepress.com/edition/2026-08-14",
    "position": 7,
    "story_type": "dispatch",
    "section": "safety-security",
    "editorial_classification": "editorial",
    "headline": "The Detection Plan Survived When Every Address Changed",
    "slug": "the-detection-plan-survived-when-every-address-changed",
    "dek": "Graph-aware retrieval produced threat-hunting plans that relied on more durable attacker behavior than vector retrieval did.",
    "summary": "Graph-aware retrieval produced threat-hunting plans that relied on more durable attacker behavior than vector retrieval did.",
    "body_text": "The experiment feeds the same incident reports and generation instructions to a knowledge-graph retrieval system and a conventional vector-retrieval system. After every IP address, domain and file hash in an APT28 report was rotated, the GraphRAG plan retained all of its detections while the comparison retained 29 percent. Nine reports from four vendors showed the same directional pattern toward harder-to-evade techniques. Prompt wording still mattered substantially, and this study evaluates generated hunting plans rather than proving operational detection performance in every security environment.",
    "why_it_matters": "Graph-aware retrieval produced threat-hunting plans that relied on more durable attacker behavior than vector retrieval did.",
    "limitations": [],
    "importance": 9,
    "canonical_url": "https://themachinepress.com/story/mp-2026-08-14-007/the-detection-plan-survived-when-every-address-changed",
    "json_url": "https://themachinepress.com/story/mp-2026-08-14-007.json",
    "first_published_at": "2026-08-14T09:00:00.000-04:00",
    "modified_at": "2026-08-14T09:00:00.000-04:00",
    "content_status": "new",
    "is_carryover": false,
    "carryover_reason": null,
    "key_claims": [
      {
        "claim_id": "claim-mp-2026-08-14-007-001",
        "text": "Graph-aware retrieval produced threat-hunting plans that relied on more durable attacker behavior than vector retrieval did.",
        "source_ids": [
          "source-2026-08-14-007"
        ],
        "qualification": null
      }
    ],
    "source_ids": [
      "source-2026-08-14-007"
    ],
    "tags": [
      "cybersecurity",
      "GraphRAG",
      "threat intelligence",
      "detection engineering"
    ],
    "image_url": null,
    "corrections": []
  },
  "sources": [
    {
      "source_id": "source-2026-08-14-007",
      "title": "arXiv preprint 2608.13050",
      "publisher": "arXiv",
      "url": "https://arxiv.org/abs/2608.13050",
      "canonical_url": "https://arxiv.org/abs/2608.13050",
      "source_type": "primary_research",
      "is_primary_source": true,
      "published_at": "2026-08-13T06:15:05.000-04:00",
      "accessed_at": "2026-08-14T08:27:00.000-04:00",
      "supports_claim_ids": [
        "claim-mp-2026-08-14-007-001"
      ]
    }
  ],
  "corrections": [],
  "publisher": {
    "name": "The Machine Press",
    "url": "https://themachinepress.com",
    "description": "A daily newspaper for the age of artificial intelligence."
  },
  "cite_this_report": {
    "title": "The Detection Plan Survived When Every Address Changed",
    "publisher": "The Machine Press",
    "published_at": "2026-08-14T09:00:00.000-04:00",
    "canonical_url": "https://themachinepress.com/story/mp-2026-08-14-007/the-detection-plan-survived-when-every-address-changed"
  }
}