Triage security alerts as a UNIX filter

01 · Role in the system

What Jev does here

For every alert Jev answers a disposition Choice (close, escalate, contain, or investigate), a 0-3 severity Score, two Noul probabilities for false positive and incident-response urgency, and a technique-category Choice. The binary validates each answer against allowed options and ranges before acting, so an invalid answer becomes an error record rather than a silent default, and an OpenAI-compatible backend can substitute for Jev with confidence treated as uncalibrated.

02 · Control boundary

Where Jev sits

One alert to five parallel typed judgments; plain code applies thresholds and routing so expensive triage tools and humans only see what survives the screen.

Code owns the loop, permissions, thresholds, validation, and side effects. Jev owns only the bounded judgments described above.

03 · Known limits

What this evidence does not prove

• The five-question rubric is a demonstration taxonomy, not a validated security-operations workflow.
• No published accuracy figures, and the OpenAI fallback path reports uncalibrated self-reported confidence.

04 · Attribution

Public sources

This is a Community record: the project was published by a third-party community author.

• m0rphtail ↗Community · github · public · checked 2026-09-18