Using Jev for security alert classification and event scoring
A security engineer embeds Jev as a decision engine in threat hunting, detection engineering and incident response to score hosts and users, group rundll32 noise and trim event timelines.
This made me rethink where AI actually fits into security engineering. For purely engineering work, forget about ChatGPT or Claude. TypeSafe AI just released Jev, and I think it’s going to change how we build AI into security workflows. Instead of asking an LLM to “investigate this,” you define the questions and possible outputs, then get structured probabilities and decisions your code can actually use. For security, the possibilities are huge. Think of the below use cases 🤯: Threat Hunting: ➡️ Rank broad hunt results by relevance ➡️ Score users, hosts, processes, or sessions based on how suspicious their surrounding activity looks ➡️ Classify noisy activity at scale. Think thousands of rundll32.exe executions automatically grouped into expected admin activity, software execution, suspicious usage, or unknown Detection Engineering: → Classify historical alerts for FP analysis → Add context-aware scoring on top of deterministic detections → Validate whether an alert actually supports the behavior the rule claims to detect Incident Response: → Reduce massive timelines down to the events most relevant to the intrusion → Continuously score hosts/users for possible compromise → Help prioritize scope expansion, triage, and response decisions This feels much closer to how AI should be integrated into security engineering. I'm currently working through most of the above, mostly focusing on instant response, but at the same time doing some of the threat hunting use cases that I mentioned. Typesafe AI can be basically a decision engine sitting inside the workflow while being x200 fast and cheaper. Don’t sleep on this... This is huge! 👉 https://typesafe.ai/
This post quotes another post: x.com/typesafeai/status/2099944756931596454