What is Jevline and what problem does it solve?

A DFIR tool that starts from one process, address, account or host an analyst has confirmed malicious and returns the whole incident: a timeline of linked activity, an execution chain and an evidence table built by asking Jev about each linked telemetry item.

How does Jevline use Jev?

It asks Jev, TypeSafe's structured-decision model, whether each process, account, host, address or domain reached through telemetry links belongs to the same incident. Whatever Jev links is followed further, round by round, until no new activity joins.

How well did it do on the recorded intrusion?

On six days of telemetry from one Windows host it found 40 of 41 analyst-confirmed attack-chain processes from 1,015,959 records (2.3 GB) in 21 seconds for $0.11, with one wrong decision at link threshold 0.8. Elastic Defend alone gave 33 of 41 and Windows event logs 37 of 41.

How does it compare with letting a general LLM answer the same questions?

The README ran GLM 5.3 Flash in Jev's place on the same questions: it found 41 of 41 but took 32.6 minutes, about 94 times longer, cost $1.06, about 10 times more, and made 8 wrong decisions versus 1. Jev answered in 0.08 s median per question against 9 s.

Is Jevline a validated detector?

No. The README labels it experimental and says a Jev score measures relatedness to the incident, not whether something is malicious, so every result needs analyst review. Treat the timeline as a lead generator for a human, not a verdict.

What telemetry can I point it at?

The benchmark runs used Elastic Defend EDR exports and Windows event logs, separately and together, and the tool follows process, network, logon and web-request links out of one confirmed starting point. The digest excerpt does not show the command-line syntax.

Who built Jevline and what licence is it under?

tsale is the owner, with 40 stars and 4 forks at review time. It is MIT licensed, written in TypeScript, created 2026-10-06 and last pushed 2026-10-15, and there is a hosted browser demo at jev-incident-timeline.vercel.app plus a command-line section.

Jev directory

CommunityJev Tools & CLIs

Jevline

Incident-response tool that starts from one confirmed-malicious process and asks Jev about every process, account, host, address and domain the telemetry links to it, growing the incident round by round into a timeline and evidence table.

See highlights Open github.com

Stars: 40
Language: TypeScript
License: MIT
Reading time: 3 min
Published by: Community
Author: tsale
Last verified: Oct 2026

tsale/jevline

User repository on GitHub

View on GitHub

Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence table.

Forks: 4
Last pushed: Updated Oct 2026

Repo stats from the GitHub API, cached Oct 2026.Homepage

Tagscommunity github security dfir incident-response

Works forJev for Classification Jev for Scoring

Used inJev for Security & Privacy

Languages: TypeScript
Platforms: CLI Browser
Capabilities: Open source

Highlights

Starts from one confirmed-malicious process, address, account or host and follows telemetry links outward round by round.
Between processes it follows children, code injection, dropped-then-run files and persistence; to the environment, network contacts, logons and web requests.
On 1,015,959 records (2.3 GB) it found 40 of 41 attack-chain processes in 21 s for $0.11, with one wrong decision at link threshold 0.8.
In Jev's place, GLM 5.3 Flash took 32.6 min, cost $1.06 and made 8 wrong decisions versus 1; Jev answered in 0.08 s median per question.
The README calls it experimental: a Jev score measures relatedness to the incident, not maliciousness, so results need analyst review.

Watch out

README reviewed 2026-10-17; the excerpt is truncated inside the model comparison and does not show the command-line or install sections, so the CLI syntax and prerequisites could not be verified; the project labels itself experimental.

Questions about this entry

Short answers drawn from the linked project or page.

Reactions & coverage

Posts, threads, and videos about this entry from around the web.

YouTube: Kubernetes admission control with a decision model, fail-closed.

Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.

2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker News

X: Jev and Laya on security queries

X: Testing Jev for prompt injection

From the Jev guides

Original write-ups on what this entry is for.

Jev at home: voice pipelines, Assist routing, and sentinels

Oct 16, 2026

How Home Assistant conversation agents, macOS voice pipelines, and an advisory sentinel put a fast typed decision in the loop — one call per utterance, thresholds in code, and a daily token budget.

Jev Tools & CLIs#home-assistant#voice#automation

Read article

Search visibility, audited by decisions

Oct 16, 2026

Jev-based SEO tools split the crawl from the call: deterministic crawlers count and parse, while typed judgments rank fixes, place internal links, score search results, and track AI-answer mentions — with costs and caveats attached.

Jev Tools & CLIs#seo#search-visibility#audits

Read article

Jev on the Gateways: Vercel, Workers AI, and OpenRouter

Oct 12, 2026

The request shape barely changes across surfaces; the surrounding contract does. When to call the API directly and when a gateway, a Worker binding, or a router entry earns its extra hop.

Jev Tools & CLIs#gateway#vercel#cloudflare

Read article

From the Jev AI model community

Posts from builders shipping with Jev right now.

Follow @typesafeai

Jevline

Highlights

Questions about this entry

What is Jevline and what problem does it solve?

How does Jevline use Jev?

How well did it do on the recorded intrusion?

How does it compare with letting a general LLM answer the same questions?

Is Jevline a validated detector?

What telemetry can I point it at?

Who built Jevline and what licence is it under?

Reactions & coverage

More Jev resources like this

From the Jev guides

From the Jev AI model community