MEDIA PREVIEW
Overview & result
Jevline helps an analyst investigate what else belongs to an incident after confirming one malicious process, account, host, address or domain. Code reads and links the telemetry. TypeSafe Jev evaluates whether connected candidates belong to the same incident, and code turns accepted links into a timeline and evidence table. Optional prose is generated separately through OpenRouter.
From the original post
Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence table.
How Jev fits in the loop
- Code normalizes records and builds links from process lineage, injection, files, network contacts and logons.
- Jev Noul evaluates each reachable candidate’s relationship to the confirmed incident; code applies thresholds and flags nearby decisions for review.
- For unfamiliar log schemas, Jev Choice classifies event types and field roles, with cached answers.
- Code assembles the timeline, execution chain and evidence table. Optional narrative generation uses a separate OpenRouter model.
How to reproduce
- Open the repository-linked browser demo and load its bundled lab example.
- Select an analyst-confirmed starting point and provide analyst context before running Analyze with Jev.
- Review the incident members, event timeline, execution chain and evidence table; inspect near-threshold decisions.
- For local use, follow the repository command-line instructions with Node.js 22.18+ and your own TypeSafe API key.
Why this build matters
Gives investigators a practical route from a confirmed starting point to a reviewable incident timeline, with recorded evidence for each link.
Limitations
- Experimental investigation aid; relatedness to an incident does not establish maliciousness. Every result needs analyst review.
- We inspected the source and demo setup, but did not independently run the analysis or reproduce the author’s benchmarks.
- With the demo key, uploaded logs go to the project server; with your own key, candidate summaries pass through its relay to TypeSafe. Optional narrative drafts go to OpenRouter.
- Results depend on the available telemetry, starting point and thresholds; some cross-host execution links are not supported.