What it is
Proof of concept for the question that follows once an analyst confirms one malicious process: what else is part of this? For each other process start, in time order, Jev gets the seed, the candidate, up to six recently linked executions, and up to eight nearby events from the same host, and returns a relatedness probability plus an evidence category.
What it does: Candidates at 0.8 or above are linked and become context for later questions; if the first pass found new links, the rest are asked once more. Accepts ECS / Elasticsearch JSON (up to 500 events in the portal); runs as a website or as a local portal and CLI that use only the Python standard library.
Why it belongs in the showcase: A clear log-triage shape for security telemetry, with linked evidence accumulating as context and a confidence cut-off before anything joins the timeline.
Caveats: No accuracy claim; experimental threshold; analyst review required.
Evidence
Public README + live demo at https://jev-incident-timeline.vercel.app/ (the demo key only works on the bundled lab example); bundled 100-record Sysmon export from a lab detonation; tests run offline with mocked providers.
Caveats
- README makes no accuracy claim: tests mock both providers and the 0.8 link threshold is experimental
- Below the threshold means not enough evidence to link, not benign; every result needs analyst review
- Selected telemetry fields go to TypeSafe (and optionally OpenRouter for narratives); no license file detected at intake
Unofficial case page. Stars / list position observed for heat; do not treat heat as a quality SLA. Review the upstream README before you depend on it.