Strange LabSign in
Cyber defense

excytin_ash_identity_benign_byprincipal

646,919events in the training captures
1model serving questions
2024 → 2024span of the captures
16results
cyber_defense · excytin_ash_identity_benign_byprincipal · World model · public
01 · Data

Dataset versions

A dataset version is a capture of the source as of a date: its event spine and the files training reads.

1 dataset version

excytin_ash_identity_benign_byprincipal excytin_ash_identity_benign_byprincipal @ asof-2026-08-12

Recorded where it is (archive drive and vei-gdrive); see REPORT.md

llm_report · REPORT.md

excytin_ash_identity_benign_byprincipal@asof-2026-08-12 — data stage report

Recorded 2026-10-13 as part of the line's migration to the factory. The data already existed and nothing was rematerialized.

Inputs, by identity. ExCyTIn-Bench, tenant alphineskihouse, the identity world. This stream is derived from excytin_ash_identity (derivation.json):

  • 1,636,564 source events over the benign window from 2024-06-20 to

2024-07-15;

  • the stream field set to the principal, so episodes are principals (918

of them);

  • 268,365 incident-activity events stripped over 73 windows.

The raw benchmark and the parent stream are external.

Output, by identity.

  • Spine: canonical_events.jsonl, 646,919 benign events.
  • Receipts: derivation.json and the ingest-time drift check.

Decisions. Recorded where it is. The spine is on the archive drive and on Google Drive (vei-gdrive:ingest-data/cyber_defense/), not on Modal. Nothing was uploaded except this report and the drift receipts.

Drift. Ingest-time: 2 monthly periods, no verb or volume flags. The check has little to compare over two periods. Training uses the whole benign stream, so a split-time check does not apply.

For the next stage. Atlas identity_v1. The retained run identity_v1 (ashid_v1) reads this stream.

Receipts (2)
drift.json
{
  "era": {
    "n_periods": 2,
    "n_events": 646919,
    "structural_types": [
      "aad_audit:add_agreement",
      "aad_audit:add_member_to_role_in_pim_completed__permanent",
      "aad_audit:add_member_to_role_in_pim_requested__permanent",
      "aad_audit:add_unverified_domain",
      "aad_audit:administrator_directly_assigns_user_to_access_package",
      "aad_audit:approvalnotification_create",
      "aad_audit:authentication_methods_policy_update",
      "aad_audit:auto_apply_review",
      "aad_audit:create_terms_of_use",
      "aad_audit:delete_conditional_access_policy",
      "aad_audit:delete_group",
      "aad_audit:delete_policy",
      "aad_audit:edit_terms_of_use",
      "aad_audit:enable_account",
      "aad_audit:finish_applying_group_based_license_to_users",
      "aad_audit:get_tenant_details",
      "aad_audit:get_user_flows",
      "aad_audit:other",
      "aad_audit:reset_password__by_blatemp",
      "aad_audit:set_group_license",
      "aad_audit:start_applying_group_based_license_to_users",
      "aad_audit:synchronization_rule_action",
      "aad_audit:update_role_setting_in_pim",
      "aad_audit:verify_domain",
      "cloudapp:add_agreement",
      "cloudapp:add_unverified_domain",
      "cloudapp:addindicator",
      "cloudapp:addrole",
      "cloudapp:adminmailaccess",
      "cloudapp:assignlicenseautoclaim",
      "cloudapp:assignusertoincident",
      "cloudapp:audit_storageaccounts",
      "cloudapp:audit_virtualmachines",
      "cloudapp:audit_virtualnetworks",
      "cloudapp:audit_workflows",
      "cloudapp:auditifnotexists_pricings",
      "cloudapp:auditifnotexists_storageaccounts",
      "cloudapp:auditifnotexists_virtualmachines",
      "cloudapp:auditifnotexists_virtualnetworks",
      "cloudapp:backup_protecteditems",
      "cloudapp:backupvalidatefeatures_locations",
      "cloudapp:begingetaccess_disks",
      "cloudapp:capabilities_locations",
      "cloudapp:clientviewsignaled",
      "cloudapp:collectinvestigationpackage",
      "cloudapp:companylinkcreated",
      "cloudapp:confirmconsentcode_connections",
      "cloudapp:createform",
      "cloudapp:createresponse",
      "cloudapp:delete_applicationgatewaywebapplicationfirewallpolicies",
      "cloudapp:delete_azurefirewalls",
      "cloudapp:delete_bastionhosts",
      "cloudapp:delete_ddosprotectionplans",
      "cloudapp:delete_disks",
      "cloudapp:delete_firewallpolicies",
      "cloudapp:delete_frontdoorwebapplicationfirewallpolicies",
      "cloudapp:delete_functions",
      "cloudapp:delete_group",
      "cloudapp:delete_ipgroups",
      "cloudapp:delete_modules",
      "cloudapp:delete_networkinterfaces",
      "cloudapp:delete_networksecuritygroups",
      "cloudapp:delete_policy",
      "cloudapp:delete_profiles",
      "cloudapp:delete_publicipaddresses",
      "cloudapp:delete_remotevirtualnetworkpeeringproxies",
      "cloudapp:delete_resourcegroups",
      "cloudapp:delete_routetables",
      "cloudapp:delete_runbooks",
      "cloudapp:delete_storageaccounts",
      "cloudapp:delete_subnets",
      "cloudapp:delete_virtualmachines",
      "cloudapp:delete_virtualnetworkpeerings",
      "cloudapp:delete_virtualnetworks",
      "cloudapp:delete_workspacesettings",
      "cloudapp:deleteindicator",
      "cloudapp:deployifnotexists_bastionhosts",
      "cloudapp:deployifnotexists_profiles",
      "cloudapp:editform",
      "cloudapp:editincidentclassification",
      "cloudapp:editrole",
      "cloudapp:enable_account",
      "cloudapp:endgetaccess_disks",
      "cloudapp:exporttemplate_deployments",
      "cloudapp:fileaccessedextended",
      "cloudapp:generate_diagnostics",
      "cloudapp:getactivesessions_bastionhosts",
      "cloudapp:inquire_protectioncontainers",
      "cloudapp:listconsentlinks_connections",
      "cloudapp:listdesigninvoked",
      "cloudapp:listforms",
      "cloudapp:listitemrecycled",
      "cloudapp:listkeys_functions",
      "cloudapp:listviewupdated",
      "cloudapp:locations_locations",
      "cloudapp:monitoringalertupdated",
      "cloudapp:moveform",
      "cloudapp:pageprefetched",
      "cloudapp:pageviewedextended",
      "cloudapp:permissionleveladded",
      "cloudapp:powerapppermissiondeleted",
      "cloudapp:powerapppermissionedited",
      "cloudapp:publish_runbooks",
      "cloudapp:putpermissions",
      "cloudapp:read_afdendpoints",
      "cloudapp:read_applicationgateways",
      "cloudapp:read_bastionhosts",
      "cloudapp:read_profiles",
      "cloudapp:read_systemtopics",
      "cloudapp:recommendoperationgroups_workflows",
      "cloudapp:refreshcontainers_backupfabrics",
      "cloudapp:register_features",
      "cloudapp:register_microsoft_advisor",
      "cloudapp:register_microsoft_alertsmanagement",
      "cloudapp:register_microsoft_appconfiguration",
      "cloudapp:register_microsoft_appplatform",
      "cloudapp:register_microsoft_cdn",
      "cloudapp:register_microsoft_compute",
      "cloudapp:register_microsoft_insights",
      "cloudapp:register_microsoft_keyvault",
      "cloudapp:register_microsoft_logic",
      "cloudapp:register_microsoft_marketplacenotifications",
      "cloudapp:register_microsoft_network",
      "cloudapp:register_microsoft_operationalinsights",
      "cloudapp:register_microsoft_operationsmanagement",
      "cloudapp:register_microsoft_resourcehealth",
      "cloudapp:register_microsoft_web",
      "cloudapp:remediationactionadded",
      "cloudapp:restart_sites",
      "cloudapp:retrievebootdiagnosticsdata_virtualmachines",
      "cloudapp:searchqueryperformed",
      "cloudapp:set_group_license",
      "cloudapp:set_unifiedgroup",
      "cloudapp:sharinglinkcreated",
      "cloudapp:sharingset",
      "cloudapp:stop_jobs",
      "cloudapp:sync_host",
      "cloudapp:updateformsetting",
      "cloudapp:updateincidentseverity",
      "cloudapp:updatereferences_firewallpolicies",
      "cloudapp:usages_origingroups",
      "cloudapp:validateupgradepath_config",
      "cloudapp:verify_domain",
      "cloudapp:viewform",
      "cloudapp:webhooks_webhooks",
      "cloudapp:write_actiongroups",
      "cloudapp:write_afdendpoints",
      "cloudapp:write_automationaccounts",
      "cloudapp:write_autoprovisioningsettings",
      "cloudapp:write_backuppolicies",
      "cloudapp:write_basicpublishingcredentialspolicies",
      "cloudapp:write_bastionhosts",
      "cloudapp:write_certificates",
      "cloudapp:write_components",
      "cloudapp:write_config",
      "cloudapp:write_connections",
      "cloudapp:write_datasources",
      "cloudapp:write_ddosprotectionplans",
      "cloudapp:write_disks",
      "cloudapp:write_eventsubscriptions",
      "cloudapp:write_extensions",
      "cloudapp:write_functions",
      "cloudapp:write_guestusages",
      "cloudapp:write_ipgroups",
      "cloudapp:write_jobschedules",
      "cloudapp:write_modules",
      "cloudapp:write_networkwatchers",
      "cloudapp:write_origingroups",
      "cloudapp:write_origins",
      "cloudapp:write_policyassignments",
      "cloudapp:write_pricings",
      "cloudapp:write_profiles",
      "cloudapp:write_properties",
      "cloudapp:write_protecteditems",
      "cloudapp:write_protectioncontainers",
      "cloudapp:write_remediations",
      "cloudapp:write_resourcegroups",
      "cloudapp:write_restorepointcollections",
      "cloudapp:write_runbooks",
      "cloudapp:write_scheduledqueryrules",
      "cloudapp:write_schedules",
      "cloudapp:write_securityoperators",
      "cloudapp:write_securitypolicies",
      "cloudapp:write_servervulnerabilityassessmentssettings",
      "cloudapp:write_sites",
      "cloudapp:write_smartdetectoralertrules",
      "cloudapp:write_systemtopics",
      "cloudapp:write_userassignedidentities",
      "cloudapp:write_vfs",
      "cloudapp:write_webhooks"
    ],
    "verb_flags": [],
    "volume_flags": [],
    "trailing_periods": 6,
    "spike_ratio": 4.0
  },
  "split": null
}
drift.txt
[drift] 646,919 events over 2 periods | structural types excluded: aad_audit:add_agreement, aad_audit:add_member_to_role_in_pim_completed__permanent, aad_audit:add_member_to_role_in_pim_requested__permanent, aad_audit:add_unverified_domain, aad_audit:administrator_directly_assigns_user_to_access_package, aad_audit:approvalnotification_create, aad_audit:authentication_methods_policy_update, aad_audit:auto_apply_review, aad_audit:create_terms_of_use, aad_audit:delete_conditional_access_policy, aad_audit:delete_group, aad_audit:delete_policy, aad_audit:edit_terms_of_use, aad_audit:enable_account, aad_audit:finish_applying_group_based_license_to_users, aad_audit:get_tenant_details, aad_audit:get_user_flows, aad_audit:other, aad_audit:reset_password__by_blatemp, aad_audit:set_group_license, aad_audit:start_applying_group_based_license_to_users, aad_audit:synchronization_rule_action, aad_audit:update_role_setting_in_pim, aad_audit:verify_domain, cloudapp:add_agreement, cloudapp:add_unverified_domain, cloudapp:addindicator, cloudapp:addrole, cloudapp:adminmailaccess, cloudapp:assignlicenseautoclaim, cloudapp:assignusertoincident, cloudapp:audit_storageaccounts, cloudapp:audit_virtualmachines, cloudapp:audit_virtualnetworks, cloudapp:audit_workflows, cloudapp:auditifnotexists_pricings, cloudapp:auditifnotexists_storageaccounts, cloudapp:auditifnotexists_virtualmachines, cloudapp:auditifnotexists_virtualnetworks, cloudapp:backup_protecteditems, cloudapp:backupvalidatefeatures_locations, cloudapp:begingetaccess_disks, cloudapp:capabilities_locations, cloudapp:clientviewsignaled, cloudapp:collectinvestigationpackage, cloudapp:companylinkcreated, cloudapp:confirmconsentcode_connections, cloudapp:createform, cloudapp:createresponse, cloudapp:delete_applicationgatewaywebapplicationfirewallpolicies, cloudapp:delete_azurefirewalls, cloudapp:delete_bastionhosts, cloudapp:delete_ddosprotectionplans, cloudapp:delete_disks, cloudapp:delete_firewallpolicies, cloudapp:delete_frontdoorwebapplicationfirewallpolicies, cloudapp:delete_functions, cloudapp:delete_group, cloudapp:delete_ipgroups, cloudapp:delete_modules, cloudapp:delete_networkinterfaces, cloudapp:delete_networksecuritygroups, cloudapp:delete_policy, cloudapp:delete_profiles, cloudapp:delete_publicipaddresses, cloudapp:delete_remotevirtualnetworkpeeringproxies, cloudapp:delete_resourcegroups, cloudapp:delete_routetables, cloudapp:delete_runbooks, cloudapp:delete_storageaccounts, cloudapp:delete_subnets, cloudapp:delete_virtualmachines, cloudapp:delete_virtualnetworkpeerings, cloudapp:delete_virtualnetworks, cloudapp:delete_workspacesettings, cloudapp:deleteindicator, cloudapp:deployifnotexists_bastionhosts, cloudapp:deployifnotexists_profiles, cloudapp:editform, cloudapp:editincidentclassification, cloudapp:editrole, cloudapp:enable_account, cloudapp:endgetaccess_disks, cloudapp:exporttemplate_deployments, cloudapp:fileaccessedextended, cloudapp:generate_diagnostics, cloudapp:getactivesessions_bastionhosts, cloudapp:inquire_protectioncontainers, cloudapp:listconsentlinks_connections, cloudapp:listdesigninvoked, cloudapp:listforms, cloudapp:listitemrecycled, cloudapp:listkeys_functions, cloudapp:listviewupdated, cloudapp:locations_locations, cloudapp:monitoringalertupdated, cloudapp:moveform, cloudapp:pageprefetched, cloudapp:pageviewedextended, cloudapp:permissionleveladded, cloudapp:powerapppermissiondeleted, cloudapp:powerapppermissionedited, cloudapp:publish_runbooks, cloudapp:putpermissions, cloudapp:read_afdendpoints, cloudapp:read_applicationgateways, cloudapp:read_bastionhosts, cloudapp:read_profiles, cloudapp:read_systemtopics, cloudapp:recommendoperationgroups_workflows, cloudapp:refreshcontainers_backupfabrics, cloudapp:register_features, cloudapp:register_microsoft_advisor, cloudapp:register_microsoft_alertsmanagement, cloudapp:register_microsoft_appconfiguration, cloudapp:register_microsoft_appplatform, cloudapp:register_microsoft_cdn, cloudapp:register_microsoft_compute, cloudapp:register_microsoft_insights, cloudapp:register_microsoft_keyvault, cloudapp:register_microsoft_logic, cloudapp:register_microsoft_marketplacenotifications, cloudapp:register_microsoft_network, cloudapp:register_microsoft_operationalinsights, cloudapp:register_microsoft_operationsmanagement, cloudapp:register_microsoft_resourcehealth, cloudapp:register_microsoft_web, cloudapp:remediationactionadded, cloudapp:restart_sites, cloudapp:retrievebootdiagnosticsdata_virtualmachines, cloudapp:searchqueryperformed, cloudapp:set_group_license, cloudapp:set_unifiedgroup, cloudapp:sharinglinkcreated, cloudapp:sharingset, cloudapp:stop_jobs, cloudapp:sync_host, cloudapp:updateformsetting, cloudapp:updateincidentseverity, cloudapp:updatereferences_firewallpolicies, cloudapp:usages_origingroups, cloudapp:validateupgradepath_config, cloudapp:verify_domain, cloudapp:viewform, cloudapp:webhooks_webhooks, cloudapp:write_actiongroups, cloudapp:write_afdendpoints, cloudapp:write_automationaccounts, cloudapp:write_autoprovisioningsettings, cloudapp:write_backuppolicies, cloudapp:write_basicpublishingcredentialspolicies, cloudapp:write_bastionhosts, cloudapp:write_certificates, cloudapp:write_components, cloudapp:write_config, cloudapp:write_connections, cloudapp:write_datasources, cloudapp:write_ddosprotectionplans, cloudapp:write_disks, cloudapp:write_eventsubscriptions, cloudapp:write_extensions, cloudapp:write_functions, cloudapp:write_guestusages, cloudapp:write_ipgroups, cloudapp:write_jobschedules, cloudapp:write_modules, cloudapp:write_networkwatchers, cloudapp:write_origingroups, cloudapp:write_origins, cloudapp:write_policyassignments, cloudapp:write_pricings, cloudapp:write_profiles, cloudapp:write_properties, cloudapp:write_protecteditems, cloudapp:write_protectioncontainers, cloudapp:write_remediations, cloudapp:write_resourcegroups, cloudapp:write_restorepointcollections, cloudapp:write_runbooks, cloudapp:write_scheduledqueryrules, cloudapp:write_schedules, cloudapp:write_securityoperators, cloudapp:write_securitypolicies, cloudapp:write_servervulnerabilityassessmentssettings, cloudapp:write_sites, cloudapp:write_smartdetectoralertrules, cloudapp:write_systemtopics, cloudapp:write_userassignedidentities, cloudapp:write_vfs, cloudapp:write_webhooks
[drift] no verb moved >=4x its own trailing median — clean
5 files, 567.0 MB
  • Event spine · 1 file566.9 MB
  • canonical_events.jsonl25d1c83b54ba566.9 MB
  • Receipt · 3 files15 kB
  • derivation.jsonb39973bb8d55861 B
  • drift.json0695f194c82e8 kB
  • drift.txt9408b8cd82206 kB
  • Phase_report · 1 file1 kB
  • REPORT.mdc68e5dca26ae1 kB
Events
646,919 in 918 streams
Span
20 Jun 2024 → 14 Jul 2024
Source
ExCyTIn-Bench alphineskihouse, identity world, benign window grouped by principal; derived from excytin_ash_identity, as of 12 Aug 2026
Published
13 Oct 2026
1 modeltrained or exported over it
identity_v1 · 13 Oct 2026
02 · Features

Featurization

An Atlas recipe declares how events become model inputs.

1 feature recipe

identity_v1 pipeline/featurize/cyber_defense/recipes/identity_v1.yaml

Used by
identity_v1
1 runtrained over it
03 · Training

Recipes and runs

A Praxis recipe fixes the model, the objective and the split.

1 training recipe
1 run

identity_v1 excytin_ash_identity_benign_byprincipal__transformer__drivers_id1__ctx16__ashid_v1_id1_lag300__20260812-152835

20 files, 832.6 MB
  • Latent matrices · 1 file662.4 MB
  • latents.npy662.4 MB
  • Auxiliary · 7 files81.6 MB
  • ARCHIVED.md922 B
  • metrics.jsonl287 B
  • scores_id_burst.parquet17.4 MB
  • scores_id_l1_ho.parquet23.0 MB
  • scores_id_n1_std_ho.parquet21.8 MB
  • scores_id_nl300_std_ho.parquet19.4 MB
  • tiers_identity.json31 kB
  • Sample and event ids · 1 file42.0 MB
  • latent_event_ids.json42.0 MB
  • Metrics · 1 file24.2 MB
  • metrics.json24.2 MB
  • Checkpoints · 2 files21.7 MB
  • model.pt5.4 MB
  • train_checkpoint.pt16.3 MB
  • Configuration · 5 files502 kB
  • asof_config.json190 B
  • config.json414 B
  • praxis_import.json215 B
  • praxis_paths.json515 B
  • praxis.json501 kB
  • Split · 1 file41 kB
  • split.json41 kB
  • Evaluation outputs · 2 files23 kB
  • gnomon/identity_known_v1/results.jsond2b218a13c4312 kB
  • gnomon/identity_v1/results.jsone0076b2b208111 kB
Status
imported
Trained on
excytin_ash_identity_benign_byprincipal @ asof-2026-08-12
Origin
manifest inferred from the directory
Published
13 Oct 2026
832.6 MB20 artifacts
04 · Evaluation

How it compares to other methods

uses the world modelother methodcoin flip

AUC is the chance a method ranks a case that happened above one that didn't: 0.5 is a coin flip, 1.0 is perfect.

Sign-in activity around 47 incidents (ExCyTIn identity world)

Trained only on a tenant's normal sign-ins, does the model's surprise rank the incidents' identity events above the rest of the following week?

Identity events tied to an incident, among accounts seen in training

World model, 1 step0.542
World model, 5 min0.508
Bursts0.701
Linear control0.508
0.500.550.600.650.700.75

Sign-in activity around 47 incidents (ExCyTIn identity world)

Trained only on a tenant's normal sign-ins, does the model's surprise rank the incidents' identity events above the rest of the following week?

Identity events tied to an incident

World model, 1 step0.502
World model, 5 min0.475
Bursts0.701
Linear control0.459
0.450.500.550.600.650.700.75

Sign-in activity around 47 incidents (ExCyTIn identity world)

Trained only on a tenant's normal sign-ins, does the model's surprise rank the incidents' identity events above the rest of the following week? Higher means incident events rank above normal ones.

Identity events tied to an incident

World model, 1 step0.502
World model, 5 min0.475
Bursts0.701
Linear control0.459
0.450.500.550.600.650.700.75

Identity events tied to an incident, among accounts seen in training

World model, 1 step0.542
World model, 5 min0.508
Bursts0.701
Linear control0.507
0.450.500.550.600.650.700.75
How they are graded: 3 eval configs

identity_known_v1 eval config · revision 1 · pipeline/infer/cyber_defense/recipes/identity_known_v1.yaml

Targets
identity_event
Arms
BURST, L1_ho, N1_std_ho, NL300_std_ho
Split
the run's own split
Uncertainty
per row, not resampled
Drift
not read into cells
4 cellsover 1 run
identity_v1

identity_v1 eval config · revision 1 · pipeline/infer/cyber_defense/recipes/identity_v1.yaml

Targets
identity_event
Arms
BURST, L1_ho, N1_std_ho, NL300_std_ho
Split
the run's own split
Uncertainty
per row, not resampled
Drift
not read into cells
4 cellsover 1 run
identity_v1

tiers_identity eval config · revision 4 · pipeline/infer/cyber_defense/recipes/migrated/tiers_identity.yaml

Targets
incidents 126-172, full
incidents 126-172, known_principal
Arms
BURST, L1_ho, N1_std_ho, NL300_std_ho
8 cellsover 1 run
identity_v1
All 16 cells, with their numbers and provenance
EvaluationRunTargetArm · headSplitNumbers
identity_known_v1 identity_v1 identity_event BURST · score the run's scored window; identity events in a target incident's window that touch its alert evidence are positive, among principals the calibration stream saw n 479,295
auc 0.701
n_pos 13,366
pr_auc 0.048
hits_at_10 0
hits_at_25 0
hits_at_50 0
lift_at_10 0
lift_at_25 0
lift_at_50 0
prevalence 0.028
hits_at_100 0
hits_at_250 0
lift_at_100 0
lift_at_250 0
identity_known_v1 identity_v1 identity_event L1_ho · score the run's scored window; identity events in a target incident's window that touch its alert evidence are positive, among principals the calibration stream saw n 479,295
auc 0.508
n_pos 13,366
pr_auc 0.027
hits_at_10 0
hits_at_25 1
hits_at_50 2
lift_at_10 0
lift_at_25 1.434
lift_at_50 1.434
prevalence 0.028
hits_at_100 10
hits_at_250 27
lift_at_100 3.586
lift_at_250 3.873
identity_known_v1 identity_v1 identity_event N1_std_ho · score the run's scored window; identity events in a target incident's window that touch its alert evidence are positive, among principals the calibration stream saw n 479,295
auc 0.542
n_pos 13,366
pr_auc 0.029
hits_at_10 1
hits_at_25 1
hits_at_50 2
lift_at_10 3.586
lift_at_25 1.434
lift_at_50 1.434
prevalence 0.028
hits_at_100 3
hits_at_250 3
lift_at_100 1.076
lift_at_250 0.43
identity_known_v1 identity_v1 identity_event NL300_std_ho · score the run's scored window; identity events in a target incident's window that touch its alert evidence are positive, among principals the calibration stream saw n 479,295
auc 0.508
n_pos 13,366
pr_auc 0.026
hits_at_10 0
hits_at_25 0
hits_at_50 2
lift_at_10 0
lift_at_25 0
lift_at_50 1.434
prevalence 0.028
hits_at_100 3
hits_at_250 3
lift_at_100 1.076
lift_at_250 0.43
identity_v1 identity_v1 identity_event BURST · score the run's scored window; identity events in a target incident's window that touch its alert evidence are positive n 712,054
auc 0.701
n_pos 13,477
pr_auc 0.034
hits_at_10 0
hits_at_25 0
hits_at_50 0
lift_at_10 0
lift_at_25 0
lift_at_50 0
prevalence 0.019
hits_at_100 0
hits_at_250 0
lift_at_100 0
lift_at_250 0
identity_v1 identity_v1 identity_event L1_ho · score the run's scored window; identity events in a target incident's window that touch its alert evidence are positive n 711,622
auc 0.459
n_pos 13,474
pr_auc 0.018
hits_at_10 2
hits_at_25 8
hits_at_50 15
lift_at_10 10.563
lift_at_25 16.901
lift_at_50 15.844
prevalence 0.019
hits_at_100 19
hits_at_250 39
lift_at_100 10.035
lift_at_250 8.239
identity_v1 identity_v1 identity_event N1_std_ho · score the run's scored window; identity events in a target incident's window that touch its alert evidence are positive n 711,622
auc 0.502
n_pos 13,474
pr_auc 0.018
hits_at_10 5
hits_at_25 7
hits_at_50 7
lift_at_10 26.407
lift_at_25 14.788
lift_at_50 7.394
prevalence 0.019
hits_at_100 9
hits_at_250 9
lift_at_100 4.753
lift_at_250 1.901
identity_v1 identity_v1 identity_event NL300_std_ho · score the run's scored window; identity events in a target incident's window that touch its alert evidence are positive n 696,134
auc 0.475
n_pos 13,421
pr_auc 0.017
hits_at_10 0
hits_at_25 0
hits_at_50 0
lift_at_10 0
lift_at_25 0
lift_at_50 0
prevalence 0.019
hits_at_100 7
hits_at_250 7
lift_at_100 3.631
lift_at_250 1.452
tiers_identity identity_v1 incidents 126-172, full BURST held-out tail from 2024-07-15T00:00:00Z n 712,054
auc 0.701
n_pos 13,474
pr_auc 0.034
findings_k 250
hits_at_10 0
hits_at_25 0
hits_at_50 0
lift_at_10 0
lift_at_25 0
lift_at_50 0
prevalence 0.019
hits_at_100 0
hits_at_250 0
lift_at_100 0
lift_at_250 0
incidents_covered 2
n_target_incidents 47
positive_behaviours 2
tiers_identity identity_v1 incidents 126-172, full L1_ho held-out tail from 2024-07-15T00:00:00Z n 711,622
auc 0.459
n_pos 13,471
pr_auc 0.018
findings_k 250
hits_at_10 2
hits_at_25 8
hits_at_50 15
lift_at_10 10.565
lift_at_25 16.904
lift_at_50 15.848
prevalence 0.019
hits_at_100 19
hits_at_250 39
lift_at_100 10.037
lift_at_250 8.241
incidents_covered 9
n_target_incidents 47
positive_behaviours 21
tiers_identity identity_v1 incidents 126-172, full N1_std_ho held-out tail from 2024-07-15T00:00:00Z n 711,622
auc 0.502
n_pos 13,471
pr_auc 0.018
findings_k 250
hits_at_10 5
hits_at_25 7
hits_at_50 7
lift_at_10 26.413
lift_at_25 14.791
lift_at_50 7.396
prevalence 0.019
hits_at_100 9
hits_at_250 9
lift_at_100 4.754
lift_at_250 1.902
incidents_covered 11
n_target_incidents 47
positive_behaviours 15
tiers_identity identity_v1 incidents 126-172, full NL300_std_ho held-out tail from 2024-07-15T00:00:00Z n 696,134
auc 0.475
n_pos 13,418
pr_auc 0.017
findings_k 250
hits_at_10 0
hits_at_25 0
hits_at_50 0
lift_at_10 0
lift_at_25 0
lift_at_50 0
prevalence 0.019
hits_at_100 7
hits_at_250 7
lift_at_100 3.632
lift_at_250 1.453
incidents_covered 8
n_target_incidents 47
positive_behaviours 12
tiers_identity identity_v1 incidents 126-172, known_principal BURST held-out tail from 2024-07-15T00:00:00Z n 479,295
auc 0.701
n_pos 13,364
pr_auc 0.048
findings_k 250
hits_at_10 0
hits_at_25 0
hits_at_50 0
lift_at_10 0
lift_at_25 0
lift_at_50 0
prevalence 0.028
hits_at_100 0
hits_at_250 0
lift_at_100 0
lift_at_250 0
incidents_covered 2
n_target_incidents 47
positive_behaviours 2
tiers_identity identity_v1 incidents 126-172, known_principal L1_ho held-out tail from 2024-07-15T00:00:00Z n 479,295
auc 0.507
n_pos 13,364
pr_auc 0.027
findings_k 250
hits_at_10 0
hits_at_25 1
hits_at_50 2
lift_at_10 0
lift_at_25 1.435
lift_at_50 1.435
prevalence 0.028
hits_at_100 10
hits_at_250 27
lift_at_100 3.586
lift_at_250 3.873
incidents_covered 7
n_target_incidents 47
positive_behaviours 22
tiers_identity identity_v1 incidents 126-172, known_principal N1_std_ho held-out tail from 2024-07-15T00:00:00Z n 479,295
auc 0.542
n_pos 13,364
pr_auc 0.029
findings_k 250
hits_at_10 1
hits_at_25 1
hits_at_50 2
lift_at_10 3.586
lift_at_25 1.435
lift_at_50 1.435
prevalence 0.028
hits_at_100 3
hits_at_250 3
lift_at_100 1.076
lift_at_250 0.43
incidents_covered 7
n_target_incidents 47
positive_behaviours 12
tiers_identity identity_v1 incidents 126-172, known_principal NL300_std_ho held-out tail from 2024-07-15T00:00:00Z n 479,295
auc 0.508
n_pos 13,364
pr_auc 0.026
findings_k 250
hits_at_10 0
hits_at_25 0
hits_at_50 2
lift_at_10 0
lift_at_25 0
lift_at_50 1.435
prevalence 0.028
hits_at_100 3
hits_at_250 3
lift_at_100 1.076
lift_at_250 0.43
incidents_covered 7
n_target_incidents 47
positive_behaviours 12
05 · Serving

Ask the model

If the query service is cold, it will need a few minutes to warm up.

Serving

idle

Published, not yet served.

This line has no query surface and no published report yet, so its model is published but answers nothing here.