triagedy
Unix filter for security alert triage: JSONL alerts in, Jev answers five typed questions, code routes each alert.
Overview
triagedy is a single Rust binary that reads security alerts as JSONL on stdin and writes typed decisions on stdout. For each alert it asks five questions modeled on NIST SP 800-61 and MITRE ATT&CK: the triage disposition (close, escalate, contain or investigate), severity on a 0 to 3 scale, whether it is a false positive, whether it needs immediate incident-response escalation, and which attacker technique category applies.
It is meant to run in front of every alert so expensive tools and analysts only see what survives the screen. By default it uses TypeSafe Jev, cited at about 200 ms per decision; a --backend openai option points at any OpenAI-compatible server such as Ollama or vLLM for on-prem use, with a warning that those confidences are uncalibrated. Every answer is validated against the defined options and ranges, and invalid answers become error records rather than silent defaults.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Choice | What is the correct triage disposition? | close · escalate · contain · investigate |
| Score | How severe if true positive? | 0.0 to 3.0 |
| Yes / no | Is this a false positive? | yes · no |
| Choice | Which attacker technique category? | none · execution · credential_access · persistence · lateral_movement · exfiltration |
How it works
- Pipe JSONL alerts into triagedy run.
- Jev (or an OpenAI-compatible backend) answers five typed questions per alert.
- Answers are validated against option sets and ranges.
- Your own code or jq routes on the resulting action.
Strengths
- Plain Unix filter: no daemon, database or framework.
- Calibrated probabilities from Jev; backend swappable for on-prem.
- Invalid answers become explicit errors.
- Grounded in NIST and MITRE categories.
Caveats
- Alternative backends give uncalibrated confidences.
- Requires building from source with Rust 1.85+.
Getting started
git clone https://github.com/m0rphtail/triagedy, build with cargo, then cat alerts.jsonl | triagedy run | jq '.action'At a glance
- Type
- Project
- Status
- beta
- Language
- Rust
- Runtime
- CLI
- Has code
- yes
Use cases and integrations
How curated lists describe it
Security alert triage as a Unix filter: JSONL alerts in, typed decisions out.
MrJev/awesome-jev
Frequently asked questions
What does triagedy decide?
Each alert's disposition, severity, false-positive likelihood, escalation need and ATT&CK technique category.
Can I keep data on-prem?
Yes, use --backend openai with a local server such as Ollama, though confidences are then uncalibrated.
How do I use the output?
Pipe it to jq or your own code; the model judges and your code decides.
Related projects
Incident-scoping tool that starts from one malicious process and asks Jev which linked telemetry belongs to the same incident.
DemoprototypeSREGym blog post on Kubernetes incident diagnosis with no LLM agent: Jev picks a root cause from collected evidence.
ArticleresearchGo CLI for managing WordPress sites at scale, with typesafe commands that ask Jev questions and a scan --triage that ranks malware findings.
ProjectproductionGoSelf-hosted Stacks blockchain data service whose Slack gate and fault-triage paths reportedly run on Jev decisions.
ServiceproductionTypeScriptHome Assistant integration that runs weekly checks with Jev judgments and turns confident findings into Repairs cards for you to confirm.
ProjectbetaPythonScores OpenTelemetry logs with Jev for diagnostic value, priority and routing before any expensive LLM analysis.
ProjectbetaTypeScript