Jevline
Incident-scoping tool that starts from one malicious process and asks Jev which linked telemetry belongs to the same incident.
Overview
Jevline helps a security analyst answer 'what else is part of this?' after one process, address, account or host is confirmed malicious. It follows every link the telemetry records out of that seed: child processes, code injection, dropped-and-run files, persistence, network contacts, logons and web requests. For each entity those links reach, Jev is asked how related it is to the incident, and entities that clear a threshold are followed further, round by round, until nothing new joins. The output is the incident, a timeline, an execution chain and an evidence table.
The README reports a test on six days of telemetry from one Windows host: with a 0.8 threshold, Jev recovered 40 of 41 attack-chain processes from combined EDR and Windows logs in 21 seconds for about $0.11, while a reasoning LLM in Jev's place found 41 but added 8 extras and took 32.6 minutes. It is explicitly experimental: the score measures relatedness, not maliciousness.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Is this linked process, account, host, address or domain part of the same incident as the seed? | — |
How it works
- Load a telemetry export (EDR or Windows event logs) and pick a confirmed seed
- Expand links from the seed to processes and environment entities
- Ask Jev for relatedness of each newly reached entity
- Follow entities above the link threshold (e.g. 0.8); mark near-misses for review
- Output timeline, execution chain and evidence table for analyst review
Strengths
- Number of model calls grows with the incident, not the log volume
- Reported seconds and cents per run on a real intrusion
- Near-threshold items are surfaced for review rather than silently dropped
- Browser demo and command line available
Caveats
- Experimental, not a validated detector
- Score is relatedness, not maliciousness; analyst review required
- Results come from a single host case study
Getting started
Try the browser version at https://jev-incident-timeline.vercel.app/ or use the command line described in the README.At a glance
- Type
- Demo
- Status
- prototype
- Runtime
- browser app and CLI
- Has code
- yes
Use cases and integrations
How curated lists describe it
Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence table.
hellogumbo/awesome-jevStarts from one confirmed-malicious process, account or host in a telemetry export and asks Jev, round by round, which linked activity belongs to the same incident; returns a timeline and evidence table for analyst review. Experimental.
MrJev/awesome-jev
Frequently asked questions
What does Jev decide in Jevline?
Whether each entity linked from the seed belongs to the same incident, as a probability compared with a threshold.
Does it say whether something is malware?
No. The README stresses that the score measures relatedness to the incident, and every result needs analyst review.
How does it compare with an LLM?
In the README's test, a reasoning LLM found one more process but added eight unrelated ones and took about 94 times longer at ten times the cost.
Related projects
Unix filter for security alert triage: JSONL alerts in, Jev answers five typed questions, code routes each alert.
ProjectbetaRustSREGym blog post on Kubernetes incident diagnosis with no LLM agent: Jev picks a root cause from collected evidence.
ArticleresearchGo CLI for managing WordPress sites at scale, with typesafe commands that ask Jev questions and a scan --triage that ranks malware findings.
ProjectproductionGoSelf-hosted Stacks blockchain data service whose Slack gate and fault-triage paths reportedly run on Jev decisions.
ServiceproductionTypeScriptHome Assistant integration that runs weekly checks with Jev judgments and turns confident findings into Repairs cards for you to confirm.
ProjectbetaPythonScores OpenTelemetry logs with Jev for diagnostic value, priority and routing before any expensive LLM analysis.
ProjectbetaTypeScript