Jevline：用 Jev 从百万条日志重建入侵时间线
开源 PoC Jevline 只让 Jev 判断与事件相关的记录，从单个恶意进程出发，在 230 万条日志中 21 秒、0.11 美元重建 41 个攻击链进程中的 40 个。
When Jev came out, this was exactly the kind of use case I had in mind. I’ve been experimenting with a variation of this in my own incident-review workflow since then, and I finally turned the idea into an open PoC and I'm calling it Jevline. The concept is pretty straightforward, give it one thing you’ve already confirmed is malicious, like a process, IP, domain, account or host. It will follow the telemetry from there to reconstruct the incident and timeline. Instead of asking Jev to reason over millions of events, Jevline only asks it about things actually connected to the incident. On one real lab intrusion, starting from a single malicious process across 2.3 GB and 1M+ records, it reconstructed 40 of 41 processes in the analyst-built attack chain in 21 seconds for $0.11. 𝗘𝗹𝗮𝘀𝘁𝗶𝗰 𝗗𝗲𝗳𝗲𝗻𝗱 705,017 records / 1.3 GB → 33/41 processes → 1 wrong decision → 10 seconds → $0.03 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗲𝘃𝗲𝗻𝘁 𝗹𝗼𝗴𝘀 310,942 records / 1.0 GB → 37/41 → 0 wrong decisions → 6 seconds → $0.03 𝗕𝗼𝘁𝗵 𝘁𝗼𝗴𝗲𝘁𝗵𝗲𝗿 1,015,959 records / 2.3 GB → 40/41 → 1 wrong decision → 21 seconds → $0.11 All three runs started from 2.8.exe alone. The analyst still reviews the result. Jev is deciding whether something belongs to the incident, not whether it is malicious. The clip below shows it working. Try it: https://jev-incident-timeline.vercel.app/ Code: https://github.com/tsale/jevline
这条是引用着另一条写的：「用 Jev 做安全告警分类与事件评分」