Jevline: rebuilding an intrusion timeline from a million logs with Jev
The open-source PoC Jevline only asks Jev about records connected to the incident, reconstructing 40 of 41 attack-chain processes from 2.3 million logs in 21 seconds for $0.11.
When Jev came out, this was exactly the kind of use case I had in mind. I’ve been experimenting with a variation of this in my own incident-review workflow since then, and I finally turned the idea into an open PoC and I'm calling it Jevline. The concept is pretty straightforward, give it one thing you’ve already confirmed is malicious, like a process, IP, domain, account or host. It will follow the telemetry from there to reconstruct the incident and timeline. Instead of asking Jev to reason over millions of events, Jevline only asks it about things actually connected to the incident. On one real lab intrusion, starting from a single malicious process across 2.3 GB and 1M+ records, it reconstructed 40 of 41 processes in the analyst-built attack chain in 21 seconds for $0.11. 𝗘𝗹𝗮𝘀𝘁𝗶𝗰 𝗗𝗲𝗳𝗲𝗻𝗱 705,017 records / 1.3 GB → 33/41 processes → 1 wrong decision → 10 seconds → $0.03 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗲𝘃𝗲𝗻𝘁 𝗹𝗼𝗴𝘀 310,942 records / 1.0 GB → 37/41 → 0 wrong decisions → 6 seconds → $0.03 𝗕𝗼𝘁𝗵 𝘁𝗼𝗴𝗲𝘁𝗵𝗲𝗿 1,015,959 records / 2.3 GB → 40/41 → 1 wrong decision → 21 seconds → $0.11 All three runs started from 2.8.exe alone. The analyst still reviews the result. Jev is deciding whether something belongs to the incident, not whether it is malicious. The clip below shows it working. Try it: https://jev-incident-timeline.vercel.app/ Code: https://github.com/tsale/jevline
This post quotes another post: “Using Jev for security alert classification and event scoring”