Jevline — Jev incident timeline

What reaches us, and what doesn't

Nothing is kept. With our free key, your logs (up to 2 MB) are sent to our server, analyzed in memory and discarded when the result is back: not stored, not logged. With your own TypeSafe key, they never leave your browser.
Our key or yours. Our TypeSafe key is free and only ever answers questions our server builds from your uploaded logs. Your own key is passed along with each request from your browser and never stored or logged.
OpenRouter goes direct. Your OpenRouter key goes straight from this browser to openrouter.ai. The page can't connect anywhere else; read the code.

Log files

Any format, any schema · several files at once

Drop log files hereJSON, NDJSON, CSV/TSV or plain text from any EDR, SIEM or log source. No mapping needed.

Starting point The process you have confirmed as malicious. Type to search the process starts in your logs. Or another starting point An address, domain, account, host or event ID instead: ip:198.51.100.66, domain:evil.example, user:svc_backup, host:srv-01. Analyst context

Actions

Load log files, or the bundled lab example, to begin.

Jev access and API keys

Our free keyUp to 2 MB of logs, analyzed on our server and not kept. My own TypeSafe keyNo size limit; runs in your browser, billed to your TypeSafe account.

OpenRouter API key Optional, only for narrative drafts. Narrative model Any OpenRouter model ID; used by Request narrative. Remember on this device Saved in this browser's local storage only. Leave unchecked on shared computers.

With our free key, the logs you load (up to 2 MB) are analyzed on our server and discarded afterwards. With your own TypeSafe key, reading and linking stay in this browser and only a summary of each candidate goes through this site's relay to TypeSafe. A narrative is a separate opt-in sent directly to OpenRouter. Jev scores are relatedness, not maliciousness.

Results

Jev assessment

No Jev decisions yet.

Narrative draft

Narrative is optional and must be requested separately.

Incident

Nothing linked yet

Confirmed starting point: your confirmation, not a Jev scoreLinked by Jev: relatedness, not a malware verdictReview: within 0.05 of the 0.8 threshold

Since start	Process or entity	Joined through	Jev

No incident yet. Load logs, choose the starting point and analyze with Jev.

Processes in the order they started; accounts, hosts, addresses and domains when they joined. ×N: the same process repeated N times (same program, command line and parent), folded into one row.

Event timeline

0 linked events

Starting point: your confirmation, not a Jev scoreJoined the incident: Jev's relatedness, not a malware verdictActivity of a linked process: exact match, not Jev-scored

No linked events yet. Import source events, confirm a starting execution and analyze with Jev to build this sequence.

The same activity repeated without any change (a beacon, a brute force, a relaunch) is one row with how many times, until when and how often.

Execution chain

No execution chain yet. Analyze with Jev to build the process chain; a narrative adds an AI-drafted version with ATT&CK mapping.

Process-to-process flow in time order. [evt:ID] links open the event in the timeline.

Evidence table

0 rows

Load an export to begin.

Timestamp	Host	Phase	Title	Description	Tools	TTPs	Command Line	Indicator	Type	Pyramid

$JEVLINE

Solana · launching soon

Contract address Coming soon

The contract address is published on this page, and pinned on the project’s account, the day the mint goes live on Solana. There is nothing to buy before then.

What the token is for

It funds the analysis, so the free tier stays free. Linking an incident costs Jev requests, and this site pays for them out of its own key — today that covers 2 MB of logs per visitor. $JEVLINE funds the same pool, so the free key keeps answering instead of being rationed.
Pay per incident, without an account. A larger export can be analyzed on this site by paying in $JEVLINE, so you never have to create a TypeSafe account or paste a key into a browser to read one incident.
Everything else stays open. Loading, linking and reading already run in your browser and stay free and un-gated. The token pays for the server side that makes them effortless — not for access to the tool.

Ticker: $JEVLINE
Chain: Solana
Launch: Coming soon
Contract: Coming soon

Verify before you buy. This page and the project’s X account are the only official sources for $JEVLINE — any other address, group or site using the name is not us. Nobody from the project will ever message you first or offer to help you buy, and no one needs your seed phrase to send you a token.

@runJEVLINE

Address, launch date and the final mechanics are published here and on X first. The plan above is pre-launch and is deliberately un-detailed: nothing here is an offer to sell.