Triple

T32733449
Position Surface form Disambiguated ID Type / Status
Subject Unit 74455 E837014 entity
Predicate associatedMalware P30269 FINISHED
Object BlackEnergy
BlackEnergy is a notorious malware toolkit best known for its use in large-scale cyber-espionage and disruptive attacks, including operations against critical infrastructure.
 E2018040 NE FINISHED

How this triple was built (3 steps)

Every LLM step that produced this triple, in pipeline order — named-entity classification, the disambiguation choices (the exact options shown, with the pick highlighted), and the generated description. The batch + timestamp of each is in the Provenance table below.

NER Named-entity recognition gpt-5-mini
Instruction
Given a phrase, classify it is english named entity (e.g., persons, organizations, works of art) in Latin script, or not (e.g., literals, dates, URLs, verbose phrases). For disambiguation, the statement where the phrase occurs as object is also given. Please return a JSON object with `phrase` (string, the phrase being analyzed) and `is_ne` (boolean, indicating whether the phrase is a Named Entity).
Input
Phrase: BlackEnergy | Statement: [Unit 74455, associatedMalware, BlackEnergy]
NEDg Description generation gpt-5.1
Instruction
Generate a one-sentence description of the target entity. 
You are given a context triple in the form (subject, predicate, object), where the object is the target entity. 
# Instructions
Use the triple to infer relevant information about the entity. Describe the entity based on what is most defining, well-known. 
Avoid repeating the information from the triple, unless really essential.
# Response Format
Return only the sentence: "Description: [one-sentence description of the target entity]"
Input
Entity: BlackEnergy
Triple: [Unit 74455, associatedMalware, BlackEnergy]
Generated description
BlackEnergy is a notorious malware toolkit best known for its use in large-scale cyber-espionage and disruptive attacks, including operations against critical infrastructure.
PD Predicate disambiguation gpt-5-mini-2025-08-07 
Target predicate: associatedMalware
Context triple: [Unit 74455, associatedMalware, BlackEnergy]
  • A. notableMalware chosen
    Indicates that the entity is recognized as a significant or well-known piece of malware, often due to its impact, prevalence, or technical characteristics.
  • B. associatedIntrusionType
    Indicates that one entity is linked to, or characterized by, a particular type or category of intrusion.
  • C. associatedWithVulnerability
    Indicates a relationship where an entity is linked to, affected by, or relevant to a specific vulnerability or security weakness.
  • D. relatedAttack
    Indicates that one attack is connected or associated with another attack, such as being part of the same incident, campaign, or sequence of actions.
  • E. associatedWithVirusSpecies
    Indicates a relationship where one entity is linked or connected to a particular virus species, typically through relevance, involvement, or attribution.
  • F. None of above.

Provenance (6 batches)

The batch behind each pipeline step, in order, with when it ran. Timestamps are batch-level — stages were processed in waves, so the object chain (NER → NED1 → NEDg → NED2) reads in order, but predicate / elicitation batches can sit in a different wave.

Step Stage Batch ID Status When
creating Elicitation batch_69f34935fb048190ad4967420581f835 completed April 30, 2026, 12:21 p.m.
NER Named-entity recognition batch_6a037cad051c8190b28b354b89208574 completed May 12, 2026, 7:17 p.m.
NED1 Entity disambiguation (via context triple) batch_6a349edcb3708190a668ce20a12a5a6f completed June 19, 2026, 1:43 a.m.
NEDg Description generation batch_6a349f8044248190bb242457861c365e completed June 19, 2026, 1:46 a.m.
NED2 Entity disambiguation (via description) batch_6a349fcf783881909cb072d0bbdbfce9 completed June 19, 2026, 1:47 a.m.
PD Predicate disambiguation batch_6a0379f0cbe481909b4b8fc6cbe297f0 completed May 12, 2026, 7:05 p.m.
Created at: May 1, 2026, 1:11 a.m.