“…This line of work typically parses system logs into dependency graphs (also known as provenance graphs) that allow to derive insights and scrutinize the causal relationships between events. Several methods have been proposed to automatically recognize security incidents from these graphs [23], [45], [83], [42], [11], [93], [35], [98], [124], to more precisely and accurately reason about the stream of events [67], [75], [65], [74], [5], or to more efficiently process queries to these graphs [71], [29], [30], [54], [55], [96]. Notably, all this work fully trusts the integrity of the logs used as input to their systems.…”