Reconstruct an Incident Timeline with Jev
这是 Kostas (tsale) 公开的项目资料。本站按原始来源展示项目信息，用中文说明适用场景和阅读边界；项目名、源帖与代码保持原样，便于逐项核对。
这条案例记录了什么
场景
安全与权限门禁、Agent 评估
提供风险或支持程度的判断信号；执行权限仍归应用规则。
证据
社区公开项目或作者演示
原始来源：Kostas (tsale) via GitHub。作者自述，本站未独立复现。
时间与作者
Kostas (tsale)
记录日期：2026-10-06。日期与身份应以原始资料为准。
怎样核对这个项目
- 先打开原始来源，确认作者、日期与 Jev 在项目中的具体用途。
- 如果提供仓库，再检查代码、运行要求和许可证；仓库存在不代表本站已经运行成功。
- 对速度、成本、准确率和规模数字，查看原文的任务、环境和计算口径。
- 高风险动作是否单独授权。
- 误判后的阻断和恢复。
- 规则是否由程序执行。
- 是否有可观察的正确答案。
原始文字与技术细节
以下内容保留原语言，供核对事实。中文页的场景说明是阅读提示，不是逐句翻译或实测结论。
展开英文项目摘要与原帖
项目摘要
Jevline helps an analyst investigate what else belongs to an incident after confirming one malicious process, account, host, address or domain. Code reads and links the telemetry. TypeSafe Jev evaluates whether connected candidates belong to the same incident, and code turns accepted links into a timeline and evidence table. Optional prose is generated separately through OpenRouter.
来源原文
Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence table.
原记录的限制
- Experimental investigation aid; relatedness to an incident does not establish maliciousness. Every result needs analyst review.
- We inspected the source and demo setup, but did not independently run the analysis or reproduce the author’s benchmarks.
- With the demo key, uploaded logs go to the project server; with your own key, candidate summaries pass through its relay to TypeSafe. Optional narrative drafts go to OpenRouter.
- Results depend on the available telemetry, starting point and thresholds; some cross-host execution links are not supported.