From 0311f252568c24d11d085376b633ce6e385044aa Mon Sep 17 00:00:00 2001
From: RKS <262019197+rksharma-owg@users.noreply.github.com>
Date: Thu, 2 Jul 2026 15:38:31 -0400
Subject: [PATCH] docs: add citation metadata

---
 CITATION.cff | 25 +++++++++++++++++++++++++
 README.md    |  1 +
 2 files changed, 26 insertions(+)
 create mode 100644 CITATION.cff

diff --git a/CITATION.cff b/CITATION.cff
new file mode 100644
index 0000000..545453a
--- /dev/null
+++ b/CITATION.cff
@@ -0,0 +1,25 @@
+cff-version: 1.2.0
+message: "If you use Harbinger in research, please cite it as below."
+type: software
+title: "Harbinger: AI-powered log pre-classifier for Microsoft Sentinel"
+abstract: >-
+  Observe-only profiler that classifies syslog events with a local Ollama model
+  and produces a per-source tier recommendation report for Microsoft Sentinel
+  cost optimisation.
+authors:
+  - family-names: "Beard"
+    given-names: "Ben"
+    email: "ben@azurebeard.co.uk"
+    affiliation: "AzureBeard"
+repository-code: "https://github.com/azurebeard/harbinger"
+url: "https://azurebeard.co.uk"
+license: Apache-2.0
+version: "1.0.1"
+date-released: "2026-06-22"
+keywords:
+  - microsoft-sentinel
+  - siem
+  - log-classification
+  - ollama
+  - syslog
+  - cost-optimization
diff --git a/README.md b/README.md
index e93568b..13b1aa8 100644
--- a/README.md
+++ b/README.md
@@ -224,6 +224,7 @@ Permanently out of scope (with rationale in [`docs/roadmap.md`](docs/roadmap.md)
 | Document | Purpose |
 |---|---|
 | [`README.md`](README.md) | You are here. |
+| [`CITATION.cff`](CITATION.cff) | Citation metadata for academic and security research. |
 | [`docs/architecture.md`](docs/architecture.md) | Full runtime architecture, trust boundaries, failure modes, non-goals. |
 | [`docs/schema.md`](docs/schema.md) | Public stability contract — JSON output, CLI, config file. |
 | [`docs/sample-profile.json`](docs/sample-profile.json) | Complete realistic example of the JSON output. |