excytin_ash_identity_benign_byprincipal

646,919events in the training captures

1model serving questions

2024 → 2024span of the captures

8results

cyber_defense · excytin_ash_identity_benign_byprincipal · World model · public

01 · Data

Dataset versions

A dataset version is a capture of the source as of a date: its event spine and the files training reads.

1 dataset version

excytin_ash_identity_benign_byprincipal excytin_ash_identity_benign_byprincipal @ asof-2026-08-12

Recorded where it is (archive drive and vei-gdrive); see REPORT.md

llm_report · REPORT.md

excytin_ash_identity_benign_byprincipal@asof-2026-08-12 — data stage report

Recorded 2026-10-13 as part of the line's migration to the factory. The data already existed and nothing was rematerialized.

Inputs, by identity. ExCyTIn-Bench, tenant alphineskihouse, the identity world. This stream is derived from excytin_ash_identity (derivation.json):

1,636,564 source events over the benign window from 2024-06-20 to

2024-07-15;

the stream field set to the principal, so episodes are principals (918

of them);

268,365 incident-activity events stripped over 73 windows.

The raw benchmark and the parent stream are external.

Output, by identity.

Spine: canonical_events.jsonl, 646,919 benign events.
Receipts: derivation.json and the ingest-time drift check.

Decisions. Recorded where it is. The spine is on the archive drive and on Google Drive (vei-gdrive:ingest-data/cyber_defense/), not on Modal. Nothing was uploaded except this report and the drift receipts.

Drift. Ingest-time: 2 monthly periods, no verb or volume flags. The check has little to compare over two periods. Training uses the whole benign stream, so a split-time check does not apply.

For the next stage. Atlas identity_v1. The retained run identity_v1 (ashid_v1) reads this stream.

Receipts (2)

drift.json

{
  "era": {
    "n_periods": 2,
    "n_events": 646919,
    "structural_types": [
      "aad_audit:add_agreement",
      "aad_audit:add_member_to_role_in_pim_completed__permanent",
      "aad_audit:add_member_to_role_in_pim_requested__permanent",
      "aad_audit:add_unverified_domain",
      "aad_audit:administrator_directly_assigns_user_to_access_package",
      "aad_audit:approvalnotification_create",
      "aad_audit:authentication_methods_policy_update",
      "aad_audit:auto_apply_review",
      "aad_audit:create_terms_of_use",
      "aad_audit:delete_conditional_access_policy",
      "aad_audit:delete_group",
      "aad_audit:delete_policy",
      "aad_audit:edit_terms_of_use",
      "aad_audit:enable_account",
      "aad_audit:finish_applying_group_based_license_to_users",
      "aad_audit:get_tenant_details",
      "aad_audit:get_user_flows",
      "aad_audit:other",
      "aad_audit:reset_password__by_blatemp",
      "aad_audit:set_group_license",
      "aad_audit:start_applying_group_based_license_to_users",
      "aad_audit:synchronization_rule_action",
      "aad_audit:update_role_setting_in_pim",
      "aad_audit:verify_domain",
      "cloudapp:add_agreement",
      "cloudapp:add_unverified_domain",
      "cloudapp:addindicator",
      "cloudapp:addrole",
      "cloudapp:adminmailaccess",
      "cloudapp:assignlicenseautoclaim",
      "cloudapp:assignusertoincident",
      "cloudapp:audit_storageaccounts",
      "cloudapp:audit_virtualmachines",
      "cloudapp:audit_virtualnetworks",
      "cloudapp:audit_workflows",
      "cloudapp:auditifnotexists_pricings",
      "cloudapp:auditifnotexists_storageaccounts",
      "cloudapp:auditifnotexists_virtualmachines",
      "cloudapp:auditifnotexists_virtualnetworks",
      "cloudapp:backup_protecteditems",
      "cloudapp:backupvalidatefeatures_locations",
      "cloudapp:begingetaccess_disks",
      "cloudapp:capabilities_locations",
      "cloudapp:clientviewsignaled",
      "cloudapp:collectinvestigationpackage",
      "cloudapp:companylinkcreated",
      "cloudapp:confirmconsentcode_connections",
      "cloudapp:createform",
      "cloudapp:createresponse",
      "cloudapp:delete_applicationgatewaywebapplicationfirewallpolicies",
      "cloudapp:delete_azurefirewalls",
      "cloudapp:delete_bastionhosts",
      "cloudapp:delete_ddosprotectionplans",
      "cloudapp:delete_disks",
      "cloudapp:delete_firewallpolicies",
      "cloudapp:delete_frontdoorwebapplicationfirewallpolicies",
      "cloudapp:delete_functions",
      "cloudapp:delete_group",
      "cloudapp:delete_ipgroups",
      "cloudapp:delete_modules",
      "cloudapp:delete_networkinterfaces",
      "cloudapp:delete_networksecuritygroups",
      "cloudapp:delete_policy",
      "cloudapp:delete_profiles",
      "cloudapp:delete_publicipaddresses",
      "cloudapp:delete_remotevirtualnetworkpeeringproxies",
      "cloudapp:delete_resourcegroups",
      "cloudapp:delete_routetables",
      "cloudapp:delete_runbooks",
      "cloudapp:delete_storageaccounts",
      "cloudapp:delete_subnets",
      "cloudapp:delete_virtualmachines",
      "cloudapp:delete_virtualnetworkpeerings",
      "cloudapp:delete_virtualnetworks",
      "cloudapp:delete_workspacesettings",
      "cloudapp:deleteindicator",
      "cloudapp:deployifnotexists_bastionhosts",
      "cloudapp:deployifnotexists_profiles",
      "cloudapp:editform",
      "cloudapp:editincidentclassification",
      "cloudapp:editrole",
      "cloudapp:enable_account",
      "cloudapp:endgetaccess_disks",
      "cloudapp:exporttemplate_deployments",
      "cloudapp:fileaccessedextended",
      "cloudapp:generate_diagnostics",
      "cloudapp:getactivesessions_bastionhosts",
      "cloudapp:inquire_protectioncontainers",
      "cloudapp:listconsentlinks_connections",
      "cloudapp:listdesigninvoked",
      "cloudapp:listforms",
      "cloudapp:listitemrecycled",
      "cloudapp:listkeys_functions",
      "cloudapp:listviewupdated",
      "cloudapp:locations_locations",
      "cloudapp:monitoringalertupdated",
      "cloudapp:moveform",
      "cloudapp:pageprefetched",
      "cloudapp:pageviewedextended",
      "cloudapp:permissionleveladded",
      "cloudapp:powerapppermissiondeleted",
      "cloudapp:powerapppermissionedited",
      "cloudapp:publish_runbooks",
      "cloudapp:putpermissions",
      "cloudapp:read_afdendpoints",
      "cloudapp:read_applicationgateways",
      "cloudapp:read_bastionhosts",
      "cloudapp:read_profiles",
      "cloudapp:read_systemtopics",
      "cloudapp:recommendoperationgroups_workflows",
      "cloudapp:refreshcontainers_backupfabrics",
      "cloudapp:register_features",
      "cloudapp:register_microsoft_advisor",
      "cloudapp:register_microsoft_alertsmanagement",
      "cloudapp:register_microsoft_appconfiguration",
      "cloudapp:register_microsoft_appplatform",
      "cloudapp:register_microsoft_cdn",
      "cloudapp:register_microsoft_compute",
      "cloudapp:register_microsoft_insights",
      "cloudapp:register_microsoft_keyvault",
      "cloudapp:register_microsoft_logic",
      "cloudapp:register_microsoft_marketplacenotifications",
      "cloudapp:register_microsoft_network",
      "cloudapp:register_microsoft_operationalinsights",
      "cloudapp:register_microsoft_operationsmanagement",
      "cloudapp:register_microsoft_resourcehealth",
      "cloudapp:register_microsoft_web",
      "cloudapp:remediationactionadded",
      "cloudapp:restart_sites",
      "cloudapp:retrievebootdiagnosticsdata_virtualmachines",
      "cloudapp:searchqueryperformed",
      "cloudapp:set_group_license",
      "cloudapp:set_unifiedgroup",
      "cloudapp:sharinglinkcreated",
      "cloudapp:sharingset",
      "cloudapp:stop_jobs",
      "cloudapp:sync_host",
      "cloudapp:updateformsetting",
      "cloudapp:updateincidentseverity",
      "cloudapp:updatereferences_firewallpolicies",
      "cloudapp:usages_origingroups",
      "cloudapp:validateupgradepath_config",
      "cloudapp:verify_domain",
      "cloudapp:viewform",
      "cloudapp:webhooks_webhooks",
      "cloudapp:write_actiongroups",
      "cloudapp:write_afdendpoints",
      "cloudapp:write_automationaccounts",
      "cloudapp:write_autoprovisioningsettings",
      "cloudapp:write_backuppolicies",
      "cloudapp:write_basicpublishingcredentialspolicies",
      "cloudapp:write_bastionhosts",
      "cloudapp:write_certificates",
      "cloudapp:write_components",
      "cloudapp:write_config",
      "cloudapp:write_connections",
      "cloudapp:write_datasources",
      "cloudapp:write_ddosprotectionplans",
      "cloudapp:write_disks",
      "cloudapp:write_eventsubscriptions",
      "cloudapp:write_extensions",
      "cloudapp:write_functions",
      "cloudapp:write_guestusages",
      "cloudapp:write_ipgroups",
      "cloudapp:write_jobschedules",
      "cloudapp:write_modules",
      "cloudapp:write_networkwatchers",
      "cloudapp:write_origingroups",
      "cloudapp:write_origins",
      "cloudapp:write_policyassignments",
      "cloudapp:write_pricings",
      "cloudapp:write_profiles",
      "cloudapp:write_properties",
      "cloudapp:write_protecteditems",
      "cloudapp:write_protectioncontainers",
      "cloudapp:write_remediations",
      "cloudapp:write_resourcegroups",
      "cloudapp:write_restorepointcollections",
      "cloudapp:write_runbooks",
      "cloudapp:write_scheduledqueryrules",
      "cloudapp:write_schedules",
      "cloudapp:write_securityoperators",
      "cloudapp:write_securitypolicies",
      "cloudapp:write_servervulnerabilityassessmentssettings",
      "cloudapp:write_sites",
      "cloudapp:write_smartdetectoralertrules",
      "cloudapp:write_systemtopics",
      "cloudapp:write_userassignedidentities",
      "cloudapp:write_vfs",
      "cloudapp:write_webhooks"
    ],
    "verb_flags": [],
    "volume_flags": [],
    "trailing_periods": 6,
    "spike_ratio": 4.0
  },
  "split": null
}

drift.txt

[drift] 646,919 events over 2 periods | structural types excluded: aad_audit:add_agreement, aad_audit:add_member_to_role_in_pim_completed__permanent, aad_audit:add_member_to_role_in_pim_requested__permanent, aad_audit:add_unverified_domain, aad_audit:administrator_directly_assigns_user_to_access_package, aad_audit:approvalnotification_create, aad_audit:authentication_methods_policy_update, aad_audit:auto_apply_review, aad_audit:create_terms_of_use, aad_audit:delete_conditional_access_policy, aad_audit:delete_group, aad_audit:delete_policy, aad_audit:edit_terms_of_use, aad_audit:enable_account, aad_audit:finish_applying_group_based_license_to_users, aad_audit:get_tenant_details, aad_audit:get_user_flows, aad_audit:other, aad_audit:reset_password__by_blatemp, aad_audit:set_group_license, aad_audit:start_applying_group_based_license_to_users, aad_audit:synchronization_rule_action, aad_audit:update_role_setting_in_pim, aad_audit:verify_domain, cloudapp:add_agreement, cloudapp:add_unverified_domain, cloudapp:addindicator, cloudapp:addrole, cloudapp:adminmailaccess, cloudapp:assignlicenseautoclaim, cloudapp:assignusertoincident, cloudapp:audit_storageaccounts, cloudapp:audit_virtualmachines, cloudapp:audit_virtualnetworks, cloudapp:audit_workflows, cloudapp:auditifnotexists_pricings, cloudapp:auditifnotexists_storageaccounts, cloudapp:auditifnotexists_virtualmachines, cloudapp:auditifnotexists_virtualnetworks, cloudapp:backup_protecteditems, cloudapp:backupvalidatefeatures_locations, cloudapp:begingetaccess_disks, cloudapp:capabilities_locations, cloudapp:clientviewsignaled, cloudapp:collectinvestigationpackage, cloudapp:companylinkcreated, cloudapp:confirmconsentcode_connections, cloudapp:createform, cloudapp:createresponse, cloudapp:delete_applicationgatewaywebapplicationfirewallpolicies, cloudapp:delete_azurefirewalls, cloudapp:delete_bastionhosts, cloudapp:delete_ddosprotectionplans, cloudapp:delete_disks, cloudapp:delete_firewallpolicies, cloudapp:delete_frontdoorwebapplicationfirewallpolicies, cloudapp:delete_functions, cloudapp:delete_group, cloudapp:delete_ipgroups, cloudapp:delete_modules, cloudapp:delete_networkinterfaces, cloudapp:delete_networksecuritygroups, cloudapp:delete_policy, cloudapp:delete_profiles, cloudapp:delete_publicipaddresses, cloudapp:delete_remotevirtualnetworkpeeringproxies, cloudapp:delete_resourcegroups, cloudapp:delete_routetables, cloudapp:delete_runbooks, cloudapp:delete_storageaccounts, cloudapp:delete_subnets, cloudapp:delete_virtualmachines, cloudapp:delete_virtualnetworkpeerings, cloudapp:delete_virtualnetworks, cloudapp:delete_workspacesettings, cloudapp:deleteindicator, cloudapp:deployifnotexists_bastionhosts, cloudapp:deployifnotexists_profiles, cloudapp:editform, cloudapp:editincidentclassification, cloudapp:editrole, cloudapp:enable_account, cloudapp:endgetaccess_disks, cloudapp:exporttemplate_deployments, cloudapp:fileaccessedextended, cloudapp:generate_diagnostics, cloudapp:getactivesessions_bastionhosts, cloudapp:inquire_protectioncontainers, cloudapp:listconsentlinks_connections, cloudapp:listdesigninvoked, cloudapp:listforms, cloudapp:listitemrecycled, cloudapp:listkeys_functions, cloudapp:listviewupdated, cloudapp:locations_locations, cloudapp:monitoringalertupdated, cloudapp:moveform, cloudapp:pageprefetched, cloudapp:pageviewedextended, cloudapp:permissionleveladded, cloudapp:powerapppermissiondeleted, cloudapp:powerapppermissionedited, cloudapp:publish_runbooks, cloudapp:putpermissions, cloudapp:read_afdendpoints, cloudapp:read_applicationgateways, cloudapp:read_bastionhosts, cloudapp:read_profiles, cloudapp:read_systemtopics, cloudapp:recommendoperationgroups_workflows, cloudapp:refreshcontainers_backupfabrics, cloudapp:register_features, cloudapp:register_microsoft_advisor, cloudapp:register_microsoft_alertsmanagement, cloudapp:register_microsoft_appconfiguration, cloudapp:register_microsoft_appplatform, cloudapp:register_microsoft_cdn, cloudapp:register_microsoft_compute, cloudapp:register_microsoft_insights, cloudapp:register_microsoft_keyvault, cloudapp:register_microsoft_logic, cloudapp:register_microsoft_marketplacenotifications, cloudapp:register_microsoft_network, cloudapp:register_microsoft_operationalinsights, cloudapp:register_microsoft_operationsmanagement, cloudapp:register_microsoft_resourcehealth, cloudapp:register_microsoft_web, cloudapp:remediationactionadded, cloudapp:restart_sites, cloudapp:retrievebootdiagnosticsdata_virtualmachines, cloudapp:searchqueryperformed, cloudapp:set_group_license, cloudapp:set_unifiedgroup, cloudapp:sharinglinkcreated, cloudapp:sharingset, cloudapp:stop_jobs, cloudapp:sync_host, cloudapp:updateformsetting, cloudapp:updateincidentseverity, cloudapp:updatereferences_firewallpolicies, cloudapp:usages_origingroups, cloudapp:validateupgradepath_config, cloudapp:verify_domain, cloudapp:viewform, cloudapp:webhooks_webhooks, cloudapp:write_actiongroups, cloudapp:write_afdendpoints, cloudapp:write_automationaccounts, cloudapp:write_autoprovisioningsettings, cloudapp:write_backuppolicies, cloudapp:write_basicpublishingcredentialspolicies, cloudapp:write_bastionhosts, cloudapp:write_certificates, cloudapp:write_components, cloudapp:write_config, cloudapp:write_connections, cloudapp:write_datasources, cloudapp:write_ddosprotectionplans, cloudapp:write_disks, cloudapp:write_eventsubscriptions, cloudapp:write_extensions, cloudapp:write_functions, cloudapp:write_guestusages, cloudapp:write_ipgroups, cloudapp:write_jobschedules, cloudapp:write_modules, cloudapp:write_networkwatchers, cloudapp:write_origingroups, cloudapp:write_origins, cloudapp:write_policyassignments, cloudapp:write_pricings, cloudapp:write_profiles, cloudapp:write_properties, cloudapp:write_protecteditems, cloudapp:write_protectioncontainers, cloudapp:write_remediations, cloudapp:write_resourcegroups, cloudapp:write_restorepointcollections, cloudapp:write_runbooks, cloudapp:write_scheduledqueryrules, cloudapp:write_schedules, cloudapp:write_securityoperators, cloudapp:write_securitypolicies, cloudapp:write_servervulnerabilityassessmentssettings, cloudapp:write_sites, cloudapp:write_smartdetectoralertrules, cloudapp:write_systemtopics, cloudapp:write_userassignedidentities, cloudapp:write_vfs, cloudapp:write_webhooks
[drift] no verb moved >=4x its own trailing median — clean

5 files, 567.0 MB

Event spine · 1 file566.9 MB
canonical_events.jsonl25d1c83b54ba566.9 MB
Receipt · 3 files15 kB
derivation.jsonb39973bb8d55861 B
drift.json0695f194c82e8 kB
drift.txt9408b8cd82206 kB
Phase_report · 1 file1 kB
REPORT.mdc68e5dca26ae1 kB

Events: 646,919 in 918 streams
Span: 20 Jun 2024 → 14 Jul 2024
Source: ExCyTIn-Bench alphineskihouse, identity world, benign window grouped by principal; derived from excytin_ash_identity, as of 12 Aug 2026
Published: 13 Oct 2026

1 modeltrained or exported over it

identity_v1 · 13 Oct 2026

02 · Features

Featurization

An Atlas recipe declares how events become model inputs.

1 feature recipe

identity_v1 pipeline/featurize/cyber_defense/recipes/identity_v1.yaml

Used by: identity_v1

1 runtrained over it

03 · Training

Recipes and runs

A Praxis recipe fixes the model, the objective and the split.

1 training recipe

identity_v1 16-event context · features identity_v1 1 run: 13 Oct 2026

1 run

identity_v1 excytin_ash_identity_benign_byprincipaltransformerdrivers_id1ctx16ashid_v1_id1_lag300__20260812-152835

20 files, 832.6 MB

Latent matrices · 1 file662.4 MB
latents.npy662.4 MB
Auxiliary · 7 files81.6 MB
ARCHIVED.md922 B
metrics.jsonl287 B
scores_id_burst.parquet17.4 MB
scores_id_l1_ho.parquet23.0 MB
scores_id_n1_std_ho.parquet21.8 MB
scores_id_nl300_std_ho.parquet19.4 MB
tiers_identity.json31 kB
Sample and event ids · 1 file42.0 MB
latent_event_ids.json42.0 MB
Metrics · 1 file24.2 MB
metrics.json24.2 MB
Checkpoints · 2 files21.7 MB
model.pt5.4 MB
train_checkpoint.pt16.3 MB
Configuration · 5 files502 kB
asof_config.json190 B
config.json414 B
praxis_import.json215 B
praxis_paths.json515 B
praxis.json501 kB
Split · 1 file41 kB
split.json41 kB
Evaluation outputs · 2 files23 kB
gnomon/identity_known_v1/results.jsond2b218a13c4312 kB
gnomon/identity_v1/results.jsone0076b2b208111 kB

Status: imported
Trained on: excytin_ash_identity_benign_byprincipal @ asof-2026-08-12
Origin: manifest inferred from the directory
Published: 13 Oct 2026

832.6 MB20 artifacts

04 · Evaluation

How it compares to other methods

uses the world modelother methodcoin flip

AUC is the chance a method ranks a case that happened above one that didn't: 0.5 is a coin flip, 1.0 is perfect.

The models of record and their headline evaluations. Every result includes the ablations and earlier variants.

Trained only on a tenant's normal sign-ins, does the model's surprise rank the incidents' identity events above the rest of the following week? Higher means incident events rank above normal ones.

Identity events tied to an incident

World model, 1 step0.502

World model, 5 min0.475

Bursts0.701

Linear control0.459

0.450.500.550.600.650.700.75

Identity events tied to an incident, among accounts seen in training

World model, 1 step0.542

World model, 5 min0.508

Bursts0.701

Linear control0.507

0.450.500.550.600.650.700.75

How it is graded: 1 eval config

tiers_identity eval config · revision 4 · pipeline/infer/cyber_defense/recipes/migrated/tiers_identity.yaml

Targets: incidents 126-172, full
incidents 126-172, known_principal
Arms: BURST, L1_ho, N1_std_ho, NL300_std_ho

8 cellsover 1 run

identity_v1

05 · Serving

Ask the model

If the query service is cold, it will need a few minutes to warm up.

Serving

idle

Published, not yet served.

This line has no query surface and no published report yet, so its model is published but answers nothing here.