A SOC pre-filter: Jev names the threat, Expanso picks the storage tier.

SourcePOST /auth-events

Expanso nodeone pipeline, 5 steps, deterministic

1. Receive
2. Shape
3. Ask Jev
4. Gate
5. Route

Jev judgment

• threat
• escalate

• siem
• warm
• cold

1. Expanso, deterministic

   Same fixed rules every time, no model involved.

2. Jev, judgment

   The one step a rule cannot write.

3. Receivelines 11 to 16

   An HTTP server input accepts auth events on POST /auth-events.

4. Shapelines 17 to 26

   Parses the POST body if it arrived as a string, then stamps received_at. It applies the same fixed rules every time, with no model involved; the timestamp is the one value that differs.

5. record + questionsanswers + confidence
6. Ask Jevlines 27 to 73

   Expanso packs the whole record and the typed questions into one request. Jev answers. If the call fails, a catch substitutes empty answers marked jev-unavailable, and the pipeline keeps going.

   • threatchoice
   • escalatenoul
7. Gatelines 74 to 87

   Fixed thresholds over Jev’s answers choose SIEM, warm, or cold.

8. Routelines 88 to 111

   A switch output writes to one file per tier.

name: jev-soc-prefilter
type: pipeline
description: SOC pre-filter with Jev — auth and access events get a threat classification and escalation judgment at the edge. Only real escalations reach the SIEM; everything else lands in cheap storage with scores attached.
namespace: production
labels:
  category: data-security
  pattern: ai-decision
  model: jev

config:
  input:
    http_server:
      address: "0.0.0.0:8080"
      path: /auth-events
      allowed_verbs: ["POST"]

  pipeline:
    processors:
      - mapping: |
          # http_server already parses JSON bodies; only parse raw strings
          root = if this.type() == "string" { this.parse_json() } else { this }

      - mapping: |
          root = this
          root.received_at = now()

      # ── Ask Jev ──
      - mutation: |
          meta jev_start = timestamp_unix_milli()

      - branch:
          request_map: |
            root = {
              "state": this.string(),
              "model": "jev-latest",
              "questions": {
                "threat": {
                  "type": "choice",
                  "instructions": "What threat pattern does this authentication event match?",
                  "criteria": {
                    "benign": "Normal user behavior, no threat indicators",
                    "brute_force": "Repeated failed logins against one account",
                    "credential_stuffing": "Many accounts tried from one source, low success rate",
                    "impossible_travel": "Logins from geographically distant locations too fast to be one person",
                    "token_abuse": "Stolen or replayed session tokens, anomalous API use",
                    "other": "Suspicious but does not match a known pattern"
                  }
                },
                "escalate": {
                  "type": "noul",
                  "instructions": "Should a security analyst review this event immediately?"
                }
              }
            }
          processors:
            - http:
                url: "${JEV_API_URL:https://api.typesafe.ai/v1/systemone}"
                verb: POST
                headers:
                  Content-Type: application/json
                  Authorization: "Bearer ${TYPESAFE_API_KEY}"
                timeout: 2s
                retries: 1
            - catch:
              - mapping: |
                  root = {"answers": {}, "model": "jev-unavailable"}
          result_map: |
            root.jev = {
              "answers": this.answers,
              "model": this.model.or("jev-latest"),
              "ms": timestamp_unix_milli() - metadata("jev_start")
            }

      # ── Confidence-gated cascade ──
      - mapping: |
          root = this
          let threat = this.jev.answers.threat.choice.or("benign")
          let escalate = this.jev.answers.escalate.noul.or(0)

          root.jev_decision = if $escalate >= 0.85 {
            "siem"
          } else if $threat != "benign" {
            "warm"
          } else {
            "cold"
          }

  output:
    broker:
      pattern: fan_out
      outputs:
        - stdout:
            codec: lines
        - switch:
            cases:
              # Production: swap for http_client -> SIEM ingestion API
              - check: this.jev_decision == "siem"
                output:
                  file:
                    path: ./data/jev-soc-prefilter/siem-${! now().ts_format("2006-01-02") }.jsonl
                    codec: lines
              - check: this.jev_decision == "warm"
                output:
                  file:
                    path: ./data/jev-soc-prefilter/warm-${! now().ts_format("2006-01-02") }.jsonl
                    codec: lines
              - check: "true"
                output:
                  file:
                    path: ./data/jev-soc-prefilter/cold-${! now().ts_format("2006-01-02") }.jsonl
                    codec: lines

111 lines. Copy and Download both give you the file byte for byte.