Jevline
Scope endpoint incidents from one malicious seed: link telemetry, ask Jev if each entity belongs, output a timeline. Experimental DFIR helper, not a detector.
Overview
Jevline (github.com/tsale/jevline) is Kostas (@tsale) experimental incident scoping tool. Start from one confirmed-malicious process, account, host, or address. The engine normalizes JSON, NDJSON, CSV, or text exports, links processes and infrastructure, then asks Jev each round whether a candidate belongs to the same incident. Default link threshold is 0.8; answers within 0.05 are marked for review. The live demo is at jev-incident-timeline.vercel.app. The GitHub repository had no LICENSE file when checked on 2026-10-07.
The README real-intrusion table on host CLA-WS-214 scores 40 of 41 attack-chain processes in 21 s for $0.11 with Jev on combined Elastic Defend and Windows logs, versus GLM 5.3 Flash in Jev's place at 32.6 min, $1.06, and 8 wrong decisions. The README states a Jev score measures relatedness to the incident, not maliciousness, and every result needs analyst review.
Problem: After one confirmed malicious process, analysts still manually chase children, injections, logons, and network links across huge telemetry exports.
Built for: DFIR and threat-hunting teams with EDR or Windows event logs who want a Jev-scored incident timeline from a single seed entity.
First indexed on Jev Directory: 2026-10-06
Creator and team
- Name
- Kostas
- Handle
- @tsale
How Jev is used
- Role in the product flow
- Repeated Noul or Choice style relatedness questions on linked entities until the incident graph stops growing
- Primitives
- NoulChoice
- State in
- Summaries of candidate processes, accounts, hosts, or addresses with links to seed and incident members plus analyst context string.
- Decision out
- Probability that the candidate belongs; members above threshold join the incident timeline output.
- Load exports in the website up to 2 MB on the free key or any size with your TypeSafe key in browser
- Pick seed process or type ip, domain, user, or host seed
- Engine links lineage, injection, files, persistence, network, and logon edges
- Jev questions run round by round; CLI analyze supports --out reports on your machine
Jevline scopes endpoint and EDR telemetry into an incident graph. box-jev-incident-triage routes Box-stored files by customer impact. gaurav-gosain-jev-sec-bench and teyhouse-jev-secret-detection are benchmark listings in the catalog, not the same interactive scoping workflow. classifier.dev could gate individual rows, but Jevline's value is multi-hop linking with hundreds of relatedness calls. Treat GLM comparison rows as same questions, different model, per README.
Sourced performance claims
- README Results table, combined logs 1,015,959 records: Jev 40/41 attack-chain processes, 1 wrong, 21 s, $0.11; GLM 5.3 Flash substitute 41/41 found but 8 wrong, 32.6 min, $1.06. Median Jev 0.08 s per question vs GLM 9 s.Source: github.com/tsale/jevline README Results on a real intrusion
- README: 337 to 1,123 Jev requests for six days of one host telemetry; questions grow with incident size, not raw log volume.Source: github.com/tsale/jevline README
- GitHub repo tsale/jevline had 30 stars on 2026-10-07. Demo URL returned HTTP 200 on 2026-10-07. No LICENSE file in the default branch tree.Source: GitHub API and HTTP check, 2026-10-07
Features and stack
Features
- Browser demo with bundled lab example malicious_events.json
- CLI engine/src/cli.ts inspect and analyze without install
- Schema-less ingest with Jev-assisted field mapping for unknown formats
- Optional OpenRouter narrative draft labeled AI generated
- Repeat folding on timeline and execution chain outputs
Stack
- TypeScript engine
- Node.js 22.18+ for CLI
- TypeSafe API or site free key capped at 2 MB uploads
- Vercel functions for analyze and relay
Pricing: Open source engine; Jev spend follows TypeSafe published token rates in README cost table or your key.
Links
FAQ
- Is Jevline a malware detector?
- No. The README says experimental, not validated. Scores measure relatedness to the seeded incident, not maliciousness. Analysts must review every member.
- What does threshold 0.8 mean?
- README: a candidate joins when probability is 0.8 or higher by default. Answers within 0.05 of the threshold get a review marker because Jev varies by a few hundredths between identical questions.
- Is there an open source license?
- GitHub API returned license null for tsale/jevline on 2026-10-07. Treat redistribution terms as unclear until a LICENSE file appears.
Related learn guides
Original Jev guidance that pairs with this product pattern.
- Jev use cases
The patterns builders actually search for: moderation, routing, triage, RAG verify, and agent gates.
- System One model
The model family behind Jev: parallel typed questions, one forward pass, probabilities you can threshold.
Related products
Hand-picked neighbors with rich profiles or overlapping tags.