Post on X
- Views
- 34,453
- Likes
- 206
- Reposts
- 18
Read from X on . Counts change daily.
Reported by the author
- Speed and cost
- x200
being x200 fast and cheaper
x.com
Tsale argues that for purely engineering work in security, a typed decision model like Jev is a better fit than ChatGPT or Claude. Instead of asking a chat model to “investigate this” in open text, you define the questions and the possible outputs, then get probabilities and decisions your code can use.
They list specific fits across three areas. In threat hunting: ranking hunt results by relevance, scoring how suspicious a user, host, process or session looks, and classifying high-volume noisy activity, for example sorting thousands of rundll32.exe executions into expected admin activity, software execution, suspicious usage or unknown. In detection engineering: classifying historical alerts for false-positive analysis, adding scoring on top of deterministic detection rules, and checking whether an alert actually supports the behavior the rule claims to detect. In incident response: cutting a large timeline down to the events most relevant to an intrusion, and continuously scoring hosts or users for possible compromise to help prioritize the response.
Tsale says they are working through most of these, mainly the incident response ones, along with some of the threat hunting cases. They describe Jev as a decision engine that sits inside the workflow while being “x200 fast and cheaper.”
