Blackboard SA: Operationalizing LLM Knowledge Source Specialization for Cyber Situational Awareness

This paper presents Blackboard SA, an applied Situation Awareness (SA) architecture that operationalizes LLM Knowledge Sources (KS) via KS specialization, deterministic pre-filters, and per-KS observability. Rather than relying on a single model for all reasoning tasks, Blackboard SA assigns distinct pipeline responsibilities to specialized KS: normalization, proposal, critique, verification, and correlation, each with independent provider and model configuration and fallback behavior. The central engineering challenge addressed is not real-time detection performance per se, but rather enhancing SA via specialized LLM reasoning within a structured pipeline: how to constrain LLM model influence, recover gracefully from LLM API provider failures and refine specialized KS LLM prompting. This paper describes the architecture, implementation, and operational controls in a production-like web environment, including queue isolation, KS toggles, fallback LLM routing, and an explicit operator control panel. Operational findings are consistent with the hypothesis that KS specialization improves situation awareness relative to monolithic LLM prompting in our deployment setting, and that deterministic non-LLM constraints are essential for production stability. The contribution is an end-to-end, inspectable SA pipeline that is configurable, reasonably LLM API fault-tolerant, and suitable for iterative applied research and practitioner deployment.