Triage security alerts as a UNIX filter

01 · Role in the system

What Jev does here

For every alert Jev answers a disposition Choice (close, escalate, contain, or investigate), a 0-3 severity Score, two Noul probabilities for false positive and incident-response urgency, and a technique-category Choice. The binary validates each answer against allowed options and ranges before acting, so an invalid answer becomes an error record rather than a silent default, and an OpenAI-compatible backend can substitute for Jev with confidence treated as uncalibrated.

Five judgments per alert, enforced by a Rust binary

The whole system is one binary that reads JSONL alerts on stdin and answers five typed questions per alert: a disposition among close, escalate, contain, or investigate; a zero-to-three severity score; two probabilities for false-positive and incident-response urgency; and a technique-category classification. Expensive triage tooling and humans only see what survives the thresholds the operator sets in code.

Validation before action is the detail that earns trust: every answer is checked against allowed options and ranges, and an invalid answer becomes an error record rather than a silent default. The model cannot smuggle a disposition the binary does not recognize, and the OpenAI-compatible fallback path marks its own confidence as uncalibrated instead of pretending parity.

A rubric, not a validated SOC workflow

The record's own boundary line is that the five-question rubric is a demonstration taxonomy, not a validated security-operations workflow — no accuracy figures exist, and the 200-millisecond per-alert latency is an author-reported approximation for one typed decision, not a benchmark.

What makes the record broadly useful is the UNIX shape: composable, scriptable, and honest about its inputs and outputs. Any team can point it at their alert stream, adjust thresholds in config rather than prompts, and measure their own precision — the evaluation this record deliberately leaves to its users.

02 · Control boundary

Where Jev sits

One alert to five parallel typed judgments; plain code applies thresholds and routing so expensive triage tools and humans only see what survives the screen.

Code owns the loop, permissions, thresholds, validation, and side effects. Jev owns only the bounded judgments described above.

03 · Known limits

What this evidence does not prove

• The five-question rubric is a demonstration taxonomy, not a validated security-operations workflow.
• No published accuracy figures, and the OpenAI fallback path reports uncalibrated self-reported confidence.

04 · Attribution

Public sources

This is a Community record: the project was published by a third-party community author.

• m0rphtail ↗Community · github · public · checked 2026-09-18