excytin_ash_train_benign_ah_byhost

1,450,520events in the training captures

3models serving questions

2024 → 2024span of the captures

72results

cyber_defense · excytin_ash_train_benign_ah_byhost · World model · public

01 · Data

Dataset versions

A dataset version is a capture of the source as of a date: its event spine and the files training reads.

1 dataset version

excytin_ash_train_benign_ah_byhost excytin_ash_train_benign_ah_byhost @ asof-2026-08-11

Recorded where it is (vei-gdrive; spine also on Modal rezendi vei-oss-data); see REPORT.md

llm_report · REPORT.md

excytin_ash_train_benign_ah_byhost@asof-2026-08-11 — data stage report

Recorded 2026-10-13 as part of the line's migration to the factory. The data already existed and nothing was rematerialized.

Inputs, by identity. ExCyTIn-Bench, tenant alphineskihouse, the advanced-hunting device world. This stream is derived from excytin_alphineskihouse_ah (derivation.json):

3,038,988 source events over the benign training windows from

2024-06-20 to 2024-07-22;

grouped by host (24 hosts);
342,701 incident-activity events stripped over 73 windows, padded by

1,800 s.

The raw benchmark and the parent streams are external: they stay on the archive drive and Google Drive.

Output, by identity.

Spine: canonical_events.jsonl, 1,450,520 benign events.
Resource: behaviour_profile.json.
Receipts: derivation.json, lag_grid.json, and the ingest-time

drift check (drift.json, drift.txt).

Decisions. Recorded where it is: at its Google Drive copy (vei-gdrive:ingest-data/cyber_defense/), which holds every file. The spine is also on the rezendi workspace's vei-oss-data volume, where the v10 runs read it. Nothing was uploaded except this report and the drift receipts.

Drift. Ingest-time: 2 monthly periods, no verb or volume flags. The check has little to compare over two periods. The retained models train on the whole benign stream (no test side) and score separate incident windows, so a split-time check inside this stream does not apply.

For the next stage. Atlas device_v1. The retained runs device_v9, device_v10 and device_aux_v10 read this stream.

Receipts (2)

drift.json

{
  "era": {
    "n_periods": 2,
    "n_events": 1450520,
    "structural_types": [
      "dvc_misc:antivirusdetection",
      "dvc_misc:appcontrolpolicyapplied",
      "dvc_misc:asrlsasscredentialtheftblocked",
      "dvc_misc:controlledfolderaccessviolationblocked",
      "dvc_misc:directoryserviceobjectcreated",
      "dvc_misc:firewalloutboundconnectionblocked",
      "dvc_misc:ntmapviewofsectionremoteapicall",
      "dvc_misc:sensitivefileread",
      "dvc_misc:useraccountmodified",
      "dvc_misc:writetolsassprocessmemory"
    ],
    "verb_flags": [],
    "volume_flags": [],
    "trailing_periods": 6,
    "spike_ratio": 4.0
  },
  "split": null
}

drift.txt

[drift] 1,450,520 events over 2 periods | structural types excluded: dvc_misc:antivirusdetection, dvc_misc:appcontrolpolicyapplied, dvc_misc:asrlsasscredentialtheftblocked, dvc_misc:controlledfolderaccessviolationblocked, dvc_misc:directoryserviceobjectcreated, dvc_misc:firewalloutboundconnectionblocked, dvc_misc:ntmapviewofsectionremoteapicall, dvc_misc:sensitivefileread, dvc_misc:useraccountmodified, dvc_misc:writetolsassprocessmemory
[drift] no verb moved >=4x its own trailing median — clean

7 files, 1.74 GB

Event spine · 1 file1.71 GB
canonical_events.jsonl36b9e45d0cb41.71 GB
Resource · 1 file22.2 MB
behaviour_profile.json74095d5c278f22.2 MB
Receipt · 4 files9 kB
derivation.jsonf65c3f15b7361 kB
drift.jsoneb43f4304441661 B
drift.txtd964c2cbfa99502 B
lag_grid.json6c0129152b566 kB
Phase_report · 1 file2 kB
REPORT.md759305bf6c3b2 kB

Events: 1,450,520 in 24 streams
Span: 20 Jun 2024 → 22 Jul 2024
Source: ExCyTIn-Bench alphineskihouse, advanced-hunting device world, benign windows grouped by host; derived from excytin_alphineskihouse_ah, as of 11 Aug 2026
Published: 13 Oct 2026

3 modelstrained or exported over it

ash_v10_noaux_ah1_lag300 · 13 Oct 2026 ash_v10_auxnexttype_ah1_lag300 · 13 Oct 2026 device_v9 · 13 Oct 2026

02 · Features

Featurization

An Atlas recipe declares how events become model inputs.

1 feature recipe

device_v1 pipeline/featurize/cyber_defense/recipes/device_v1.yaml

Used by: device_v9

1 runtrained over it

03 · Training

Recipes and runs

A Praxis recipe fixes the model, the objective and the split.

3 training recipes

device_aux_v10 16-event context · features device_v1 · heads next type weight 1 run: 13 Oct 2026
device_v10 16-event context · features device_v1 1 run: 13 Oct 2026
device_v9 16-event context · features device_v1 1 run: 13 Oct 2026

3 runs

device_v9 excytin_ash_train_benign_ah_byhosttransformerdrivers_ah1ctx16ash_v9r_heldout_ah1_lag300__20260820-005405

20 files, 1.65 GB

Latent matrices · 1 file1.49 GB
latents.npy1.49 GB
Sample and event ids · 1 file103.0 MB
latent_event_ids.json103.0 MB
Metrics · 1 file27.1 MB
metrics.json27.1 MB
Checkpoints · 2 files21.6 MB
model.pt5.4 MB
train_checkpoint.pt16.2 MB
Auxiliary · 8 files8.4 MB
ARCHIVED.md926 B
metrics.jsonl288 B
scores_l1_ho.parquet2.6 MB
scores_n1_std_ho.parquet2.3 MB
scores_nl300_std_ho.parquet1.9 MB
scores_nl3600_std_ho.parquet1.6 MB
tiers_inc134_heldout.json21 kB
tiers_inc134.json16 kB
Configuration · 5 files503 kB
asof_config.json190 B
config.json414 B
praxis_import.json213 B
praxis_paths.json509 B
praxis.json502 kB
Evaluation outputs · 1 file14 kB
gnomon/tiers_inc134_v1/results.jsond587957283bc14 kB
Split · 1 file869 B
split.json869 B

Status: imported
Trained on: excytin_ash_train_benign_ah_byhost @ asof-2026-08-11
Origin: manifest inferred from the directory
Published: 13 Oct 2026

1.65 GB20 artifacts

ash_v10_auxnexttype_ah1_lag300 ash_v10_auxnexttype_ah1_lag300

22 files, 1.65 GB

Auxiliary · 16 files1.61 GB
asof_config.json190 B
config.json414 B
latent_event_ids.json103.0 MB
latents.npy1.49 GB
metrics.jsonl545 B
readout_heads.pt45 kB
scores_l1_ho.parquet2.6 MB
scores_n1_std_ho.parquet2.3 MB
scores_nl300_std_ho.parquet1.9 MB
scores_nl3600_std_ho.parquet1.6 MB
scores_provenance.json716 B
scores_vtl300_ho.parquet1.6 MB
split.json869 B
tiers_inc134_heads.json5 kB
tiers_inc134_heldout.json21 kB
train_checkpoint.pt16.3 MB
Metrics · 1 file27.1 MB
metrics.json27.1 MB
Checkpoints · 1 file5.4 MB
model.pt5.4 MB
Configuration · 3 files502 kB
praxis_import.json218 B
praxis_paths.json299 B
praxis.json502 kB
Evaluation outputs · 1 file13 kB
gnomon/tiers_inc134_v1/results.jsondc616a575e9713 kB

Status: imported
Trained on: excytin_ash_train_benign_ah_byhost @ asof-2026-08-11
Origin: manifest inferred from the directory
Published: 13 Oct 2026

1.65 GB22 artifacts

ash_v10_noaux_ah1_lag300 ash_v10_noaux_ah1_lag300

21 files, 1.65 GB

Latent matrices · 1 file1.49 GB
latents.npy1.49 GB
Sample and event ids · 1 file103.0 MB
latent_event_ids.json103.0 MB
Metrics · 1 file27.1 MB
metrics.json27.1 MB
Checkpoints · 2 files21.6 MB
model.pt5.4 MB
train_checkpoint.pt16.2 MB
Auxiliary · 8 files8.4 MB
metrics.jsonl545 B
remote.json147 B
scores_l1_ho.parquet2.6 MB
scores_n1_std_ho.parquet2.3 MB
scores_nl300_std_ho.parquet1.9 MB
scores_nl3600_std_ho.parquet1.6 MB
scores_provenance.json577 B
tiers_inc134_heldout.json22 kB
Configuration · 6 files513 kB
asof_config.json190 B
config.json414 B
praxis_import.json214 B
praxis_paths.json287 B
praxis.json502 kB
run_manifest.json10 kB
Evaluation outputs · 1 file13 kB
gnomon/tiers_inc134_v1/results.jsona3631dcb6c0813 kB
Split · 1 file869 B
split.json869 B

Status: imported
Trained on: excytin_ash_train_benign_ah_byhost @ asof-2026-08-11
Origin: not recorded
Published: 13 Oct 2026

1.65 GB21 artifacts

04 · Evaluation

How it compares to other methods

uses the world modelother methodcoin flip

AUC is the chance a method ranks a case that happened above one that didn't: 0.5 is a coin flip, 1.0 is perfect.

tiers inc134 (recorded at migration)

Incident 134, event tier

N1 std ho0.905

NL300 std ho0.790

L1 ho0.665

0.500.600.700.800.90

Incident 134, window tier

N1 std ho0.741

NL300 std ho0.708

L1 ho0.784

0.500.600.700.800.90

tiers inc134 heads (recorded at migration)

Incident 134, event tier

VTL300 ho0.505

0.500.550.600.65

Incident 134, window tier

VTL300 ho0.640

0.500.550.600.65

A security incident the model never saw (ExCyTIn incident 134)

Trained only on a tenant's normal device activity, does the model's surprise single out the attack when it comes? Higher means the attack's events or time windows rank above the normal ones.

Events that belong to the attack

World model, 1 step0.905

World model, 5 min0.790

World model, 1 hour0.600

Linear control0.665

0.500.600.700.800.90

Time windows that contain the attack

World model, 1 step0.741

World model, 5 min0.708

World model, 1 hour0.679

Linear control0.784

0.500.600.700.800.90

Across the 3 trained runs

Prediction	device_v9	ash_v10_auxnexttype_ah1_lag300	ash_v10_noaux_ah1_lag300
Events that belong to the attack	0.905	0.904	0.895
Time windows that contain the attack	0.741	0.708	0.704

A security incident the model never saw (ExCyTIn incident 134)

Trained only on a tenant's normal device activity, does the model's surprise single out the attack when it comes? Higher means the attack's events or time windows rank above the normal ones.

Events that belong to the attack

World model, 1 step0.901

World model, 5 min0.780

World model, 1 hour0.587

Linear control0.665

0.500.600.700.800.90

Time windows that contain the attack

World model, 1 step0.741

World model, 5 min0.708

World model, 1 hour0.679

Linear control0.784

0.500.600.700.800.90

Across the 3 trained runs

Prediction	device_v9	ash_v10_auxnexttype_ah1_lag300	ash_v10_noaux_ah1_lag300
Events that belong to the attack	0.901	0.904	0.891
Time windows that contain the attack	0.741	0.708	0.704

How they are graded: 4 eval configs

tiers_inc134 eval config · revision 2 · pipeline/infer/cyber_defense/recipes/migrated/tiers_inc134.yaml

Targets: incident 134, event tier
incident 134, window tier
Arms: L1_ho, N1_std_ho, NL300_std_ho

9 cellsover 1 run

device_v9

tiers_inc134_heads eval config · revision 1 · pipeline/infer/cyber_defense/recipes/migrated/tiers_inc134_heads.yaml

Targets: incident 134, event tier
incident 134, window tier
Arms: VTL300_ho

3 cellsover 1 run

ash_v10_auxnexttype_ah1_lag300

tiers_inc134_heldout eval config · revision 4 · pipeline/infer/cyber_defense/recipes/migrated/tiers_inc134_heldout.yaml

Targets: incident 134, event tier
incident 134, window tier
Arms: L1_ho, N1_std_ho, NL300_std_ho, NL3600_std_ho

36 cellsover 3 runs

device_v9 ash_v10_noaux_ah1_lag300 ash_v10_auxnexttype_ah1_lag300

tiers_inc134_v1 eval config · revision 1 · pipeline/infer/cyber_defense/recipes/tiers_inc134_v1.yaml

Targets: event_tier
window_tier
Arms: L1_ho, N1_std_ho, NL300_std_ho, NL3600_std_ho
Split: the run's own split
Uncertainty: per row, not resampled
Drift: not read into cells

24 cellsover 3 runs

device_v9 ash_v10_noaux_ah1_lag300 ash_v10_auxnexttype_ah1_lag300

All 72 cells, with their numbers and provenance

Evaluation	Run	Target	Arm · head	Split	Numbers
tiers_inc134	device_v9	incident 134, event tier	L1_ho	held-out incident windows (heldout)	n 103,621 auc 0.665 n_pos 189 pr_auc 0.004 hits_at_10 0 hits_at_25 0 hits_at_50 0 lift_at_10 0 lift_at_25 0 lift_at_50 0 prevalence 0.002 hits_at_100 0 hits_at_250 0 lift_at_100 0 lift_at_250 0
tiers_inc134	device_v9	incident 134, event tier	N1_std_ho	held-out incident windows (heldout)	n 103,621 auc 0.905 n_pos 189 pr_auc 0.021 hits_at_10 1 hits_at_25 1 hits_at_50 1 lift_at_10 54.826 lift_at_25 21.93 lift_at_50 10.965 prevalence 0.002 hits_at_100 1 hits_at_250 1 lift_at_100 5.483 lift_at_250 2.193
tiers_inc134	device_v9	incident 134, event tier	NL300_std_ho	held-out incident windows (heldout)	n 90,850 auc 0.79 n_pos 50 pr_auc 0.025 hits_at_10 1 hits_at_25 1 hits_at_50 1 lift_at_10 181.7 lift_at_25 72.68 lift_at_50 36.34 prevalence 0.001 hits_at_100 1 hits_at_250 1 lift_at_100 18.17 lift_at_250 7.268
tiers_inc134	device_v9	incident 134, findings tier	L1_ho	held-out incident windows (heldout)	n_events 103,621 hits_at_10 0 hits_at_25 0 hits_at_50 0 duplication 4.258 hits_at_100 0 hits_at_250 0 n_behaviours 24,336 n_pos_behaviours 43 incident_coverage_at_10 0 incident_coverage_at_25 0 incident_coverage_at_50 0 incident_coverage_at_100 0 incident_coverage_at_250 0 distinct_behaviours_at_10 0 distinct_behaviours_at_25 0 distinct_behaviours_at_50 0 distinct_behaviours_at_100 0 distinct_behaviours_at_250 0
tiers_inc134	device_v9	incident 134, findings tier	N1_std_ho	held-out incident windows (heldout)	n_events 103,621 hits_at_10 1 hits_at_25 1 hits_at_50 1 duplication 4.258 hits_at_100 1 hits_at_250 1 n_behaviours 24,336 n_pos_behaviours 43 incident_coverage_at_10 1 incident_coverage_at_25 1 incident_coverage_at_50 1 incident_coverage_at_100 1 incident_coverage_at_250 1 distinct_behaviours_at_10 1 distinct_behaviours_at_25 1 distinct_behaviours_at_50 1 distinct_behaviours_at_100 1 distinct_behaviours_at_250 1
tiers_inc134	device_v9	incident 134, findings tier	NL300_std_ho	held-out incident windows (heldout)	n_events 90,850 hits_at_10 1 hits_at_25 1 hits_at_50 1 duplication 3.895 hits_at_100 1 hits_at_250 1 n_behaviours 23,322 n_pos_behaviours 29 incident_coverage_at_10 1 incident_coverage_at_25 1 incident_coverage_at_50 1 incident_coverage_at_100 1 incident_coverage_at_250 1 distinct_behaviours_at_10 1 distinct_behaviours_at_25 1 distinct_behaviours_at_50 1 distinct_behaviours_at_100 1 distinct_behaviours_at_250 1
tiers_inc134	device_v9	incident 134, window tier	L1_ho	held-out incident windows (heldout)	n 288 auc 0.784 n_pos 10 pr_auc 0.182 hits_at_5 0 lift_at_5 0 hits_at_10 3 hits_at_25 5 hits_at_50 7 lift_at_10 8.64 lift_at_25 5.76 lift_at_50 4.032 prevalence 0.035
tiers_inc134	device_v9	incident 134, window tier	N1_std_ho	held-out incident windows (heldout)	n 288 auc 0.741 n_pos 10 pr_auc 0.138 hits_at_5 1 lift_at_5 5.76 hits_at_10 1 hits_at_25 3 hits_at_50 4 lift_at_10 2.88 lift_at_25 3.456 lift_at_50 2.304 prevalence 0.035
tiers_inc134	device_v9	incident 134, window tier	NL300_std_ho	held-out incident windows (heldout)	n 287 auc 0.708 n_pos 10 pr_auc 0.179 hits_at_5 1 lift_at_5 5.74 hits_at_10 1 hits_at_25 2 hits_at_50 4 lift_at_10 2.87 lift_at_25 2.296 lift_at_50 2.296 prevalence 0.035
tiers_inc134_heads	ash_v10_auxnexttype_ah1_lag300	incident 134, event tier	VTL300_ho	held-out incident windows (heads)	n 90,850 auc 0.505 n_pos 50 pr_auc 0.001 hits_at_10 0 hits_at_25 0 hits_at_50 0 lift_at_10 0 lift_at_25 0 lift_at_50 0 prevalence 0.001 hits_at_100 0 hits_at_250 0 lift_at_100 0 lift_at_250 0
tiers_inc134_heads	ash_v10_auxnexttype_ah1_lag300	incident 134, findings tier	VTL300_ho	held-out incident windows (heads)	n_events 90,850 hits_at_10 0 hits_at_25 0 hits_at_50 0 duplication 3.895 hits_at_100 0 hits_at_250 0 n_behaviours 23,322 n_pos_behaviours 29 incident_coverage_at_10 0 incident_coverage_at_25 0 incident_coverage_at_50 0 incident_coverage_at_100 0 incident_coverage_at_250 0 distinct_behaviours_at_10 0 distinct_behaviours_at_25 0 distinct_behaviours_at_50 0 distinct_behaviours_at_100 0 distinct_behaviours_at_250 0
tiers_inc134_heads	ash_v10_auxnexttype_ah1_lag300	incident 134, window tier	VTL300_ho	held-out incident windows (heads)	n 287 auc 0.64 n_pos 10 pr_auc 0.062 hits_at_5 0 lift_at_5 0 hits_at_10 0 hits_at_25 1 hits_at_50 3 lift_at_10 0 lift_at_25 1.148 lift_at_50 1.722 prevalence 0.035
tiers_inc134_heldout	device_v9	incident 134, event tier	L1_ho	held-out incident windows (heldout)	n 103,621 auc 0.665 n_pos 189 pr_auc 0.004 hits_at_10 0 hits_at_25 0 hits_at_50 0 lift_at_10 0 lift_at_25 0 lift_at_50 0 prevalence 0.002 hits_at_100 0 hits_at_250 0 lift_at_100 0 lift_at_250 0
tiers_inc134_heldout	ash_v10_noaux_ah1_lag300	incident 134, event tier	L1_ho	held-out incident windows (heldout)	n 103,621 auc 0.665 n_pos 189 pr_auc 0.004 hits_at_10 0 hits_at_25 0 hits_at_50 0 lift_at_10 0 lift_at_25 0 lift_at_50 0 prevalence 0.002 hits_at_100 0 hits_at_250 0 lift_at_100 0 lift_at_250 0
tiers_inc134_heldout	ash_v10_auxnexttype_ah1_lag300	incident 134, event tier	L1_ho	held-out incident windows (heldout)	n 103,621 auc 0.665 n_pos 189 pr_auc 0.004 hits_at_10 0 hits_at_25 0 hits_at_50 0 lift_at_10 0 lift_at_25 0 lift_at_50 0 prevalence 0.002 hits_at_100 0 hits_at_250 0 lift_at_100 0 lift_at_250 0
tiers_inc134_heldout	device_v9	incident 134, event tier	N1_std_ho	held-out incident windows (heldout)	n 103,621 auc 0.905 n_pos 189 pr_auc 0.021 hits_at_10 1 hits_at_25 1 hits_at_50 1 lift_at_10 54.826 lift_at_25 21.93 lift_at_50 10.965 prevalence 0.002 hits_at_100 1 hits_at_250 1 lift_at_100 5.483 lift_at_250 2.193
tiers_inc134_heldout	ash_v10_noaux_ah1_lag300	incident 134, event tier	N1_std_ho	held-out incident windows (heldout)	n 103,621 auc 0.895 n_pos 189 pr_auc 0.02 hits_at_10 1 hits_at_25 1 hits_at_50 1 lift_at_10 54.826 lift_at_25 21.93 lift_at_50 10.965 prevalence 0.002 hits_at_100 1 hits_at_250 1 lift_at_100 5.483 lift_at_250 2.193
tiers_inc134_heldout	ash_v10_auxnexttype_ah1_lag300	incident 134, event tier	N1_std_ho	held-out incident windows (heldout)	n 103,621 auc 0.904 n_pos 189 pr_auc 0.021 hits_at_10 1 hits_at_25 1 hits_at_50 1 lift_at_10 54.826 lift_at_25 21.93 lift_at_50 10.965 prevalence 0.002 hits_at_100 1 hits_at_250 1 lift_at_100 5.483 lift_at_250 2.193
tiers_inc134_heldout	device_v9	incident 134, event tier	NL300_std_ho	held-out incident windows (heldout)	n 90,850 auc 0.79 n_pos 50 pr_auc 0.025 hits_at_10 1 hits_at_25 1 hits_at_50 1 lift_at_10 181.7 lift_at_25 72.68 lift_at_50 36.34 prevalence 0.001 hits_at_100 1 hits_at_250 1 lift_at_100 18.17 lift_at_250 7.268
tiers_inc134_heldout	ash_v10_noaux_ah1_lag300	incident 134, event tier	NL300_std_ho	held-out incident windows (heldout)	n 90,850 auc 0.778 n_pos 50 pr_auc 0.015 hits_at_10 1 hits_at_25 1 hits_at_50 1 lift_at_10 181.7 lift_at_25 72.68 lift_at_50 36.34 prevalence 0.001 hits_at_100 1 hits_at_250 1 lift_at_100 18.17 lift_at_250 7.268
tiers_inc134_heldout	ash_v10_auxnexttype_ah1_lag300	incident 134, event tier	NL300_std_ho	held-out incident windows (heldout)	n 90,850 auc 0.771 n_pos 50 pr_auc 0.024 hits_at_10 1 hits_at_25 1 hits_at_50 1 lift_at_10 181.7 lift_at_25 72.68 lift_at_50 36.34 prevalence 0.001 hits_at_100 1 hits_at_250 1 lift_at_100 18.17 lift_at_250 7.268
tiers_inc134_heldout	device_v9	incident 134, event tier	NL3600_std_ho	held-out incident windows (heldout)	n 75,859 auc 0.6 n_pos 21 pr_auc 0.001 hits_at_10 0 hits_at_25 0 hits_at_50 0 lift_at_10 0 lift_at_25 0 lift_at_50 0 prevalence 0 hits_at_100 0 hits_at_250 0 lift_at_100 0 lift_at_250 0
tiers_inc134_heldout	ash_v10_noaux_ah1_lag300	incident 134, event tier	NL3600_std_ho	held-out incident windows (heldout)	n 75,859 auc 0.671 n_pos 21 pr_auc 0.001 hits_at_10 0 hits_at_25 0 hits_at_50 0 lift_at_10 0 lift_at_25 0 lift_at_50 0 prevalence 0 hits_at_100 0 hits_at_250 0 lift_at_100 0 lift_at_250 0
tiers_inc134_heldout	ash_v10_auxnexttype_ah1_lag300	incident 134, event tier	NL3600_std_ho	held-out incident windows (heldout)	n 75,859 auc 0.648 n_pos 21 pr_auc 0.001 hits_at_10 0 hits_at_25 0 hits_at_50 0 lift_at_10 0 lift_at_25 0 lift_at_50 0 prevalence 0 hits_at_100 0 hits_at_250 0 lift_at_100 0 lift_at_250 0
tiers_inc134_heldout	device_v9	incident 134, findings tier	L1_ho	held-out incident windows (heldout)	n_events 103,621 hits_at_10 0 hits_at_25 0 hits_at_50 0 duplication 4.258 hits_at_100 0 hits_at_250 0 n_behaviours 24,336 n_pos_behaviours 43 incident_coverage_at_10 0 incident_coverage_at_25 0 incident_coverage_at_50 0 incident_coverage_at_100 0 incident_coverage_at_250 0 distinct_behaviours_at_10 0 distinct_behaviours_at_25 0 distinct_behaviours_at_50 0 distinct_behaviours_at_100 0 distinct_behaviours_at_250 0
tiers_inc134_heldout	ash_v10_noaux_ah1_lag300	incident 134, findings tier	L1_ho	held-out incident windows (heldout)	n_events 103,621 hits_at_10 0 hits_at_25 0 hits_at_50 0 duplication 4.258 hits_at_100 0 hits_at_250 0 n_behaviours 24,336 n_pos_behaviours 43 incident_coverage_at_10 0 incident_coverage_at_25 0 incident_coverage_at_50 0 incident_coverage_at_100 0 incident_coverage_at_250 0 distinct_behaviours_at_10 0 distinct_behaviours_at_25 0 distinct_behaviours_at_50 0 distinct_behaviours_at_100 0 distinct_behaviours_at_250 0
tiers_inc134_heldout	ash_v10_auxnexttype_ah1_lag300	incident 134, findings tier	L1_ho	held-out incident windows (heldout)	n_events 103,621 hits_at_10 0 hits_at_25 0 hits_at_50 0 duplication 4.258 hits_at_100 0 hits_at_250 0 n_behaviours 24,336 n_pos_behaviours 43 incident_coverage_at_10 0 incident_coverage_at_25 0 incident_coverage_at_50 0 incident_coverage_at_100 0 incident_coverage_at_250 0 distinct_behaviours_at_10 0 distinct_behaviours_at_25 0 distinct_behaviours_at_50 0 distinct_behaviours_at_100 0 distinct_behaviours_at_250 0
tiers_inc134_heldout	device_v9	incident 134, findings tier	N1_std_ho	held-out incident windows (heldout)	n_events 103,621 hits_at_10 1 hits_at_25 1 hits_at_50 1 duplication 4.258 hits_at_100 1 hits_at_250 1 n_behaviours 24,336 n_pos_behaviours 43 incident_coverage_at_10 1 incident_coverage_at_25 1 incident_coverage_at_50 1 incident_coverage_at_100 1 incident_coverage_at_250 1 distinct_behaviours_at_10 1 distinct_behaviours_at_25 1 distinct_behaviours_at_50 1 distinct_behaviours_at_100 1 distinct_behaviours_at_250 1
tiers_inc134_heldout	ash_v10_noaux_ah1_lag300	incident 134, findings tier	N1_std_ho	held-out incident windows (heldout)	n_events 103,621 hits_at_10 1 hits_at_25 1 hits_at_50 1 duplication 4.258 hits_at_100 1 hits_at_250 1 n_behaviours 24,336 n_pos_behaviours 43 incident_coverage_at_10 1 incident_coverage_at_25 1 incident_coverage_at_50 1 incident_coverage_at_100 1 incident_coverage_at_250 1 distinct_behaviours_at_10 1 distinct_behaviours_at_25 1 distinct_behaviours_at_50 1 distinct_behaviours_at_100 1 distinct_behaviours_at_250 1
tiers_inc134_heldout	ash_v10_auxnexttype_ah1_lag300	incident 134, findings tier	N1_std_ho	held-out incident windows (heldout)	n_events 103,621 hits_at_10 1 hits_at_25 1 hits_at_50 1 duplication 4.258 hits_at_100 1 hits_at_250 1 n_behaviours 24,336 n_pos_behaviours 43 incident_coverage_at_10 1 incident_coverage_at_25 1 incident_coverage_at_50 1 incident_coverage_at_100 1 incident_coverage_at_250 1 distinct_behaviours_at_10 1 distinct_behaviours_at_25 1 distinct_behaviours_at_50 1 distinct_behaviours_at_100 1 distinct_behaviours_at_250 1
tiers_inc134_heldout	device_v9	incident 134, findings tier	NL300_std_ho	held-out incident windows (heldout)	n_events 90,850 hits_at_10 1 hits_at_25 1 hits_at_50 1 duplication 3.895 hits_at_100 1 hits_at_250 1 n_behaviours 23,322 n_pos_behaviours 29 incident_coverage_at_10 1 incident_coverage_at_25 1 incident_coverage_at_50 1 incident_coverage_at_100 1 incident_coverage_at_250 1 distinct_behaviours_at_10 1 distinct_behaviours_at_25 1 distinct_behaviours_at_50 1 distinct_behaviours_at_100 1 distinct_behaviours_at_250 1
tiers_inc134_heldout	ash_v10_noaux_ah1_lag300	incident 134, findings tier	NL300_std_ho	held-out incident windows (heldout)	n_events 90,850 hits_at_10 1 hits_at_25 1 hits_at_50 1 duplication 3.895 hits_at_100 1 hits_at_250 1 n_behaviours 23,322 n_pos_behaviours 29 incident_coverage_at_10 1 incident_coverage_at_25 1 incident_coverage_at_50 1 incident_coverage_at_100 1 incident_coverage_at_250 1 distinct_behaviours_at_10 1 distinct_behaviours_at_25 1 distinct_behaviours_at_50 1 distinct_behaviours_at_100 1 distinct_behaviours_at_250 1
tiers_inc134_heldout	ash_v10_auxnexttype_ah1_lag300	incident 134, findings tier	NL300_std_ho	held-out incident windows (heldout)	n_events 90,850 hits_at_10 1 hits_at_25 1 hits_at_50 1 duplication 3.895 hits_at_100 1 hits_at_250 1 n_behaviours 23,322 n_pos_behaviours 29 incident_coverage_at_10 1 incident_coverage_at_25 1 incident_coverage_at_50 1 incident_coverage_at_100 1 incident_coverage_at_250 1 distinct_behaviours_at_10 1 distinct_behaviours_at_25 1 distinct_behaviours_at_50 1 distinct_behaviours_at_100 1 distinct_behaviours_at_250 1
tiers_inc134_heldout	device_v9	incident 134, findings tier	NL3600_std_ho	held-out incident windows (heldout)	n_events 75,859 hits_at_10 0 hits_at_25 0 hits_at_50 0 duplication 3.62 hits_at_100 0 hits_at_250 0 n_behaviours 20,957 n_pos_behaviours 17 incident_coverage_at_10 0 incident_coverage_at_25 0 incident_coverage_at_50 0 incident_coverage_at_100 0 incident_coverage_at_250 0 distinct_behaviours_at_10 0 distinct_behaviours_at_25 0 distinct_behaviours_at_50 0 distinct_behaviours_at_100 0 distinct_behaviours_at_250 0
tiers_inc134_heldout	ash_v10_noaux_ah1_lag300	incident 134, findings tier	NL3600_std_ho	held-out incident windows (heldout)	n_events 75,859 hits_at_10 0 hits_at_25 0 hits_at_50 0 duplication 3.62 hits_at_100 0 hits_at_250 0 n_behaviours 20,957 n_pos_behaviours 17 incident_coverage_at_10 0 incident_coverage_at_25 0 incident_coverage_at_50 0 incident_coverage_at_100 0 incident_coverage_at_250 0 distinct_behaviours_at_10 0 distinct_behaviours_at_25 0 distinct_behaviours_at_50 0 distinct_behaviours_at_100 0 distinct_behaviours_at_250 0
tiers_inc134_heldout	ash_v10_auxnexttype_ah1_lag300	incident 134, findings tier	NL3600_std_ho	held-out incident windows (heldout)	n_events 75,859 hits_at_10 0 hits_at_25 0 hits_at_50 0 duplication 3.62 hits_at_100 0 hits_at_250 0 n_behaviours 20,957 n_pos_behaviours 17 incident_coverage_at_10 0 incident_coverage_at_25 0 incident_coverage_at_50 0 incident_coverage_at_100 0 incident_coverage_at_250 0 distinct_behaviours_at_10 0 distinct_behaviours_at_25 0 distinct_behaviours_at_50 0 distinct_behaviours_at_100 0 distinct_behaviours_at_250 0
tiers_inc134_heldout	device_v9	incident 134, window tier	L1_ho	held-out incident windows (heldout)	n 288 auc 0.784 n_pos 10 pr_auc 0.182 hits_at_5 0 lift_at_5 0 hits_at_10 3 hits_at_25 5 hits_at_50 7 lift_at_10 8.64 lift_at_25 5.76 lift_at_50 4.032 prevalence 0.035
tiers_inc134_heldout	ash_v10_noaux_ah1_lag300	incident 134, window tier	L1_ho	held-out incident windows (heldout)	n 288 auc 0.784 n_pos 10 pr_auc 0.182 hits_at_5 0 lift_at_5 0 hits_at_10 3 hits_at_25 5 hits_at_50 7 lift_at_10 8.64 lift_at_25 5.76 lift_at_50 4.032 prevalence 0.035
tiers_inc134_heldout	ash_v10_auxnexttype_ah1_lag300	incident 134, window tier	L1_ho	held-out incident windows (heldout)	n 288 auc 0.784 n_pos 10 pr_auc 0.182 hits_at_5 0 lift_at_5 0 hits_at_10 3 hits_at_25 5 hits_at_50 7 lift_at_10 8.64 lift_at_25 5.76 lift_at_50 4.032 prevalence 0.035
tiers_inc134_heldout	device_v9	incident 134, window tier	N1_std_ho	held-out incident windows (heldout)	n 288 auc 0.741 n_pos 10 pr_auc 0.138 hits_at_5 1 lift_at_5 5.76 hits_at_10 1 hits_at_25 3 hits_at_50 4 lift_at_10 2.88 lift_at_25 3.456 lift_at_50 2.304 prevalence 0.035
tiers_inc134_heldout	ash_v10_noaux_ah1_lag300	incident 134, window tier	N1_std_ho	held-out incident windows (heldout)	n 288 auc 0.69 n_pos 10 pr_auc 0.125 hits_at_5 1 lift_at_5 5.76 hits_at_10 1 hits_at_25 3 hits_at_50 4 lift_at_10 2.88 lift_at_25 3.456 lift_at_50 2.304 prevalence 0.035
tiers_inc134_heldout	ash_v10_auxnexttype_ah1_lag300	incident 134, window tier	N1_std_ho	held-out incident windows (heldout)	n 288 auc 0.701 n_pos 10 pr_auc 0.189 hits_at_5 1 lift_at_5 5.76 hits_at_10 1 hits_at_25 3 hits_at_50 4 lift_at_10 2.88 lift_at_25 3.456 lift_at_50 2.304 prevalence 0.035
tiers_inc134_heldout	device_v9	incident 134, window tier	NL300_std_ho	held-out incident windows (heldout)	n 287 auc 0.708 n_pos 10 pr_auc 0.179 hits_at_5 1 lift_at_5 5.74 hits_at_10 1 hits_at_25 2 hits_at_50 4 lift_at_10 2.87 lift_at_25 2.296 lift_at_50 2.296 prevalence 0.035
tiers_inc134_heldout	ash_v10_noaux_ah1_lag300	incident 134, window tier	NL300_std_ho	held-out incident windows (heldout)	n 287 auc 0.704 n_pos 10 pr_auc 0.125 hits_at_5 1 lift_at_5 5.74 hits_at_10 1 hits_at_25 2 hits_at_50 4 lift_at_10 2.87 lift_at_25 2.296 lift_at_50 2.296 prevalence 0.035
tiers_inc134_heldout	ash_v10_auxnexttype_ah1_lag300	incident 134, window tier	NL300_std_ho	held-out incident windows (heldout)	n 287 auc 0.708 n_pos 10 pr_auc 0.178 hits_at_5 1 lift_at_5 5.74 hits_at_10 1 hits_at_25 2 hits_at_50 4 lift_at_10 2.87 lift_at_25 2.296 lift_at_50 2.296 prevalence 0.035
tiers_inc134_heldout	device_v9	incident 134, window tier	NL3600_std_ho	held-out incident windows (heldout)	n 276 auc 0.679 n_pos 10 pr_auc 0.075 hits_at_5 0 lift_at_5 0 hits_at_10 1 hits_at_25 2 hits_at_50 4 lift_at_10 2.76 lift_at_25 2.208 lift_at_50 2.208 prevalence 0.036
tiers_inc134_heldout	ash_v10_noaux_ah1_lag300	incident 134, window tier	NL3600_std_ho	held-out incident windows (heldout)	n 276 auc 0.658 n_pos 10 pr_auc 0.071 hits_at_5 0 lift_at_5 0 hits_at_10 1 hits_at_25 2 hits_at_50 3 lift_at_10 2.76 lift_at_25 2.208 lift_at_50 1.656 prevalence 0.036
tiers_inc134_heldout	ash_v10_auxnexttype_ah1_lag300	incident 134, window tier	NL3600_std_ho	held-out incident windows (heldout)	n 276 auc 0.652 n_pos 10 pr_auc 0.073 hits_at_5 0 lift_at_5 0 hits_at_10 1 hits_at_25 2 hits_at_50 3 lift_at_10 2.76 lift_at_25 2.208 lift_at_50 1.656 prevalence 0.036
tiers_inc134_v1	device_v9	event_tier	L1_ho · score	the run's scored window; events in a target incident's window that match its alert evidence are positive	n 103,621 auc 0.665 n_pos 190 pr_auc 0.004 hits_at_10 0 hits_at_25 0 hits_at_50 0 lift_at_10 0 lift_at_25 0 lift_at_50 0 prevalence 0.002 hits_at_100 0 hits_at_250 0 lift_at_100 0 lift_at_250 0
tiers_inc134_v1	ash_v10_noaux_ah1_lag300	event_tier	L1_ho · score	the run's scored window; events in a target incident's window that match its alert evidence are positive	n 103,621 auc 0.665 n_pos 190 pr_auc 0.004 hits_at_10 0 hits_at_25 0 hits_at_50 0 lift_at_10 0 lift_at_25 0 lift_at_50 0 prevalence 0.002 hits_at_100 0 hits_at_250 0 lift_at_100 0 lift_at_250 0
tiers_inc134_v1	ash_v10_auxnexttype_ah1_lag300	event_tier	L1_ho · score	the run's scored window; events in a target incident's window that match its alert evidence are positive	n 103,621 auc 0.665 n_pos 190 pr_auc 0.004 hits_at_10 0 hits_at_25 0 hits_at_50 0 lift_at_10 0 lift_at_25 0 lift_at_50 0 prevalence 0.002 hits_at_100 0 hits_at_250 0 lift_at_100 0 lift_at_250 0
tiers_inc134_v1	device_v9	event_tier	N1_std_ho · score	the run's scored window; events in a target incident's window that match its alert evidence are positive	n 103,621 auc 0.901 n_pos 190 pr_auc 0.021 hits_at_10 1 hits_at_25 1 hits_at_50 1 lift_at_10 54.537 lift_at_25 21.815 lift_at_50 10.907 prevalence 0.002 hits_at_100 1 hits_at_250 1 lift_at_100 5.454 lift_at_250 2.181
tiers_inc134_v1	ash_v10_noaux_ah1_lag300	event_tier	N1_std_ho · score	the run's scored window; events in a target incident's window that match its alert evidence are positive	n 103,621 auc 0.891 n_pos 190 pr_auc 0.02 hits_at_10 1 hits_at_25 1 hits_at_50 1 lift_at_10 54.537 lift_at_25 21.815 lift_at_50 10.907 prevalence 0.002 hits_at_100 1 hits_at_250 1 lift_at_100 5.454 lift_at_250 2.181
tiers_inc134_v1	ash_v10_auxnexttype_ah1_lag300	event_tier	N1_std_ho · score	the run's scored window; events in a target incident's window that match its alert evidence are positive	n 103,621 auc 0.904 n_pos 190 pr_auc 0.021 hits_at_10 1 hits_at_25 1 hits_at_50 1 lift_at_10 54.537 lift_at_25 21.815 lift_at_50 10.907 prevalence 0.002 hits_at_100 1 hits_at_250 1 lift_at_100 5.454 lift_at_250 2.181
tiers_inc134_v1	device_v9	event_tier	NL300_std_ho · score	the run's scored window; events in a target incident's window that match its alert evidence are positive	n 90,850 auc 0.78 n_pos 51 pr_auc 0.024 hits_at_10 1 hits_at_25 1 hits_at_50 1 lift_at_10 178.137 lift_at_25 71.255 lift_at_50 35.627 prevalence 0.001 hits_at_100 1 hits_at_250 1 lift_at_100 17.814 lift_at_250 7.125
tiers_inc134_v1	ash_v10_noaux_ah1_lag300	event_tier	NL300_std_ho · score	the run's scored window; events in a target incident's window that match its alert evidence are positive	n 90,850 auc 0.769 n_pos 51 pr_auc 0.014 hits_at_10 1 hits_at_25 1 hits_at_50 1 lift_at_10 178.137 lift_at_25 71.255 lift_at_50 35.627 prevalence 0.001 hits_at_100 1 hits_at_250 1 lift_at_100 17.814 lift_at_250 7.125
tiers_inc134_v1	ash_v10_auxnexttype_ah1_lag300	event_tier	NL300_std_ho · score	the run's scored window; events in a target incident's window that match its alert evidence are positive	n 90,850 auc 0.761 n_pos 51 pr_auc 0.024 hits_at_10 1 hits_at_25 1 hits_at_50 1 lift_at_10 178.137 lift_at_25 71.255 lift_at_50 35.627 prevalence 0.001 hits_at_100 1 hits_at_250 1 lift_at_100 17.814 lift_at_250 7.125
tiers_inc134_v1	device_v9	event_tier	NL3600_std_ho · score	the run's scored window; events in a target incident's window that match its alert evidence are positive	n 75,859 auc 0.587 n_pos 22 pr_auc 0.001 hits_at_10 0 hits_at_25 0 hits_at_50 0 lift_at_10 0 lift_at_25 0 lift_at_50 0 prevalence 0 hits_at_100 0 hits_at_250 0 lift_at_100 0 lift_at_250 0
tiers_inc134_v1	ash_v10_noaux_ah1_lag300	event_tier	NL3600_std_ho · score	the run's scored window; events in a target incident's window that match its alert evidence are positive	n 75,859 auc 0.653 n_pos 22 pr_auc 0.001 hits_at_10 0 hits_at_25 0 hits_at_50 0 lift_at_10 0 lift_at_25 0 lift_at_50 0 prevalence 0 hits_at_100 0 hits_at_250 0 lift_at_100 0 lift_at_250 0
tiers_inc134_v1	ash_v10_auxnexttype_ah1_lag300	event_tier	NL3600_std_ho · score	the run's scored window; events in a target incident's window that match its alert evidence are positive	n 75,859 auc 0.631 n_pos 22 pr_auc 0.001 hits_at_10 0 hits_at_25 0 hits_at_50 0 lift_at_10 0 lift_at_25 0 lift_at_50 0 prevalence 0 hits_at_100 0 hits_at_250 0 lift_at_100 0 lift_at_250 0
tiers_inc134_v1	device_v9	window_tier	L1_ho · score	the run's scored window in five-minute buckets; a bucket overlapping a target incident's window is positive	n 288 auc 0.784 n_pos 10 pr_auc 0.182 hits_at_5 0 lift_at_5 0 hits_at_10 3 hits_at_25 5 hits_at_50 7 lift_at_10 8.64 lift_at_25 5.76 lift_at_50 4.032 prevalence 0.035
tiers_inc134_v1	ash_v10_noaux_ah1_lag300	window_tier	L1_ho · score	the run's scored window in five-minute buckets; a bucket overlapping a target incident's window is positive	n 288 auc 0.784 n_pos 10 pr_auc 0.182 hits_at_5 0 lift_at_5 0 hits_at_10 3 hits_at_25 5 hits_at_50 7 lift_at_10 8.64 lift_at_25 5.76 lift_at_50 4.032 prevalence 0.035
tiers_inc134_v1	ash_v10_auxnexttype_ah1_lag300	window_tier	L1_ho · score	the run's scored window in five-minute buckets; a bucket overlapping a target incident's window is positive	n 288 auc 0.784 n_pos 10 pr_auc 0.182 hits_at_5 0 lift_at_5 0 hits_at_10 3 hits_at_25 5 hits_at_50 7 lift_at_10 8.64 lift_at_25 5.76 lift_at_50 4.032 prevalence 0.035
tiers_inc134_v1	device_v9	window_tier	N1_std_ho · score	the run's scored window in five-minute buckets; a bucket overlapping a target incident's window is positive	n 288 auc 0.741 n_pos 10 pr_auc 0.138 hits_at_5 1 lift_at_5 5.76 hits_at_10 1 hits_at_25 3 hits_at_50 4 lift_at_10 2.88 lift_at_25 3.456 lift_at_50 2.304 prevalence 0.035
tiers_inc134_v1	ash_v10_noaux_ah1_lag300	window_tier	N1_std_ho · score	the run's scored window in five-minute buckets; a bucket overlapping a target incident's window is positive	n 288 auc 0.69 n_pos 10 pr_auc 0.125 hits_at_5 1 lift_at_5 5.76 hits_at_10 1 hits_at_25 3 hits_at_50 4 lift_at_10 2.88 lift_at_25 3.456 lift_at_50 2.304 prevalence 0.035
tiers_inc134_v1	ash_v10_auxnexttype_ah1_lag300	window_tier	N1_std_ho · score	the run's scored window in five-minute buckets; a bucket overlapping a target incident's window is positive	n 288 auc 0.701 n_pos 10 pr_auc 0.189 hits_at_5 1 lift_at_5 5.76 hits_at_10 1 hits_at_25 3 hits_at_50 4 lift_at_10 2.88 lift_at_25 3.456 lift_at_50 2.304 prevalence 0.035
tiers_inc134_v1	device_v9	window_tier	NL300_std_ho · score	the run's scored window in five-minute buckets; a bucket overlapping a target incident's window is positive	n 287 auc 0.708 n_pos 10 pr_auc 0.179 hits_at_5 1 lift_at_5 5.74 hits_at_10 1 hits_at_25 2 hits_at_50 4 lift_at_10 2.87 lift_at_25 2.296 lift_at_50 2.296 prevalence 0.035
tiers_inc134_v1	ash_v10_noaux_ah1_lag300	window_tier	NL300_std_ho · score	the run's scored window in five-minute buckets; a bucket overlapping a target incident's window is positive	n 287 auc 0.704 n_pos 10 pr_auc 0.125 hits_at_5 1 lift_at_5 5.74 hits_at_10 1 hits_at_25 2 hits_at_50 4 lift_at_10 2.87 lift_at_25 2.296 lift_at_50 2.296 prevalence 0.035
tiers_inc134_v1	ash_v10_auxnexttype_ah1_lag300	window_tier	NL300_std_ho · score	the run's scored window in five-minute buckets; a bucket overlapping a target incident's window is positive	n 287 auc 0.708 n_pos 10 pr_auc 0.178 hits_at_5 1 lift_at_5 5.74 hits_at_10 1 hits_at_25 2 hits_at_50 4 lift_at_10 2.87 lift_at_25 2.296 lift_at_50 2.296 prevalence 0.035
tiers_inc134_v1	device_v9	window_tier	NL3600_std_ho · score	the run's scored window in five-minute buckets; a bucket overlapping a target incident's window is positive	n 276 auc 0.679 n_pos 10 pr_auc 0.075 hits_at_5 0 lift_at_5 0 hits_at_10 1 hits_at_25 2 hits_at_50 4 lift_at_10 2.76 lift_at_25 2.208 lift_at_50 2.208 prevalence 0.036
tiers_inc134_v1	ash_v10_noaux_ah1_lag300	window_tier	NL3600_std_ho · score	the run's scored window in five-minute buckets; a bucket overlapping a target incident's window is positive	n 276 auc 0.658 n_pos 10 pr_auc 0.071 hits_at_5 0 lift_at_5 0 hits_at_10 1 hits_at_25 2 hits_at_50 3 lift_at_10 2.76 lift_at_25 2.208 lift_at_50 1.656 prevalence 0.036
tiers_inc134_v1	ash_v10_auxnexttype_ah1_lag300	window_tier	NL3600_std_ho · score	the run's scored window in five-minute buckets; a bucket overlapping a target incident's window is positive	n 276 auc 0.652 n_pos 10 pr_auc 0.073 hits_at_5 0 lift_at_5 0 hits_at_10 1 hits_at_25 2 hits_at_50 3 lift_at_10 2.76 lift_at_25 2.208 lift_at_50 1.656 prevalence 0.036

05 · Serving

Ask the model

If the query service is cold, it will need a few minutes to warm up.

Serving

idle

Published, not yet served.

This line has no query surface and no published report yet, so its models are published but answers nothing here.

excytin_ash_train_benign_ah_byhost

Dataset versions

excytin_ash_train_benign_ah_byhost excytin_ash_train_benign_ah_byhost @ asof-2026-08-11

excytin_ash_train_benign_ah_byhost@asof-2026-08-11 — data stage report

Featurization

device_v1 pipeline/featurize/cyber_defense/recipes/device_v1.yaml

Recipes and runs

device_v9 excytin_ash_train_benign_ah_byhost__transformer__drivers_ah1__ctx16__ash_v9r_heldout_ah1_lag300__20260820-005405

ash_v10_auxnexttype_ah1_lag300 ash_v10_auxnexttype_ah1_lag300

ash_v10_noaux_ah1_lag300 ash_v10_noaux_ah1_lag300

How it compares to other methods

tiers inc134 (recorded at migration)

Incident 134, event tier

Incident 134, window tier

tiers inc134 heads (recorded at migration)

Incident 134, event tier

Incident 134, window tier

A security incident the model never saw (ExCyTIn incident 134)

Events that belong to the attack

Time windows that contain the attack

A security incident the model never saw (ExCyTIn incident 134)

Events that belong to the attack

Time windows that contain the attack

tiers_inc134 eval config · revision 2 · pipeline/infer/cyber_defense/recipes/migrated/tiers_inc134.yaml

tiers_inc134_heads eval config · revision 1 · pipeline/infer/cyber_defense/recipes/migrated/tiers_inc134_heads.yaml

tiers_inc134_heldout eval config · revision 4 · pipeline/infer/cyber_defense/recipes/migrated/tiers_inc134_heldout.yaml

tiers_inc134_v1 eval config · revision 1 · pipeline/infer/cyber_defense/recipes/tiers_inc134_v1.yaml

Ask the model

Serving

Published, not yet served.

device_v9 excytin_ash_train_benign_ah_byhosttransformerdrivers_ah1ctx16ash_v9r_heldout_ah1_lag300__20260820-005405