excytin_ash_train_benign_ah_byhost excytin_ash_train_benign_ah_byhost @ asof-2026-08-11
Recorded where it is (vei-gdrive; spine also on Modal rezendi vei-oss-data); see REPORT.md
llm_report · REPORT.md
excytin_ash_train_benign_ah_byhost@asof-2026-08-11 — data stage report
Recorded 2026-10-13 as part of the line's migration to the factory. The data already existed and nothing was rematerialized.
Inputs, by identity. ExCyTIn-Bench, tenant alphineskihouse, the advanced-hunting device world. This stream is derived from excytin_alphineskihouse_ah (derivation.json):
- 3,038,988 source events over the benign training windows from
2024-06-20 to 2024-07-22;
- grouped by host (24 hosts);
- 342,701 incident-activity events stripped over 73 windows, padded by
1,800 s.
The raw benchmark and the parent streams are external: they stay on the archive drive and Google Drive.
Output, by identity.
- Spine:
canonical_events.jsonl, 1,450,520 benign events. - Resource:
behaviour_profile.json. - Receipts:
derivation.json,lag_grid.json, and the ingest-time
drift check (drift.json, drift.txt).
Decisions. Recorded where it is: at its Google Drive copy (vei-gdrive:ingest-data/cyber_defense/), which holds every file. The spine is also on the rezendi workspace's vei-oss-data volume, where the v10 runs read it. Nothing was uploaded except this report and the drift receipts.
Drift. Ingest-time: 2 monthly periods, no verb or volume flags. The check has little to compare over two periods. The retained models train on the whole benign stream (no test side) and score separate incident windows, so a split-time check inside this stream does not apply.
For the next stage. Atlas device_v1. The retained runs device_v9, device_v10 and device_aux_v10 read this stream.
Receipts (2)
drift.json{
"era": {
"n_periods": 2,
"n_events": 1450520,
"structural_types": [
"dvc_misc:antivirusdetection",
"dvc_misc:appcontrolpolicyapplied",
"dvc_misc:asrlsasscredentialtheftblocked",
"dvc_misc:controlledfolderaccessviolationblocked",
"dvc_misc:directoryserviceobjectcreated",
"dvc_misc:firewalloutboundconnectionblocked",
"dvc_misc:ntmapviewofsectionremoteapicall",
"dvc_misc:sensitivefileread",
"dvc_misc:useraccountmodified",
"dvc_misc:writetolsassprocessmemory"
],
"verb_flags": [],
"volume_flags": [],
"trailing_periods": 6,
"spike_ratio": 4.0
},
"split": null
}drift.txt[drift] 1,450,520 events over 2 periods | structural types excluded: dvc_misc:antivirusdetection, dvc_misc:appcontrolpolicyapplied, dvc_misc:asrlsasscredentialtheftblocked, dvc_misc:controlledfolderaccessviolationblocked, dvc_misc:directoryserviceobjectcreated, dvc_misc:firewalloutboundconnectionblocked, dvc_misc:ntmapviewofsectionremoteapicall, dvc_misc:sensitivefileread, dvc_misc:useraccountmodified, dvc_misc:writetolsassprocessmemory [drift] no verb moved >=4x its own trailing median — clean
7 files, 1.74 GB
- Event spine · 1 file1.71 GB
canonical_events.jsonl36b9e45d0cb41.71 GB- Resource · 1 file22.2 MB
behaviour_profile.json74095d5c278f22.2 MB- Receipt · 4 files9 kB
derivation.jsonf65c3f15b7361 kBdrift.jsoneb43f4304441661 Bdrift.txtd964c2cbfa99502 Blag_grid.json6c0129152b566 kB- Phase_report · 1 file2 kB
REPORT.md759305bf6c3b2 kB
- Events
- 1,450,520 in 24 streams
- Span
- 20 Jun 2024 → 22 Jul 2024
- Source
- ExCyTIn-Bench alphineskihouse, advanced-hunting device world, benign windows grouped by host; derived from excytin_alphineskihouse_ah, as of 11 Aug 2026
- Published
- 13 Oct 2026