jeff.security.socv1.4.0

Security alert triage

Applies a security team's playbook to an alert and recommends ignoring, investigating, isolating, blocking or escalating it.

Open in playground

Example

Context

organisation: A regional logistics company; this queue handles alerts from the laptops' endpoint protection.
playbook: 1. Ransomware behaviour (many files renamed or encrypted quickly) on any laptop: isolate the laptop. 2. A known malicious outside address contacted: block the address. 3. A login from a new country for an administrator: escalate. 4. Anything else that fired: investigate. Allowed actions: block, isolate, escalate, investigate, ignore.

Input

Alert: suspicious file activity on laptop LT-0441 (user: warehouse planner). In 90 seconds, 2,314 files in the user's documents folder were renamed with the extension .locked. Process: an unsigned program started from the downloads folder.

Answer (JSON)

value isolate, confidence 0.795

Top options

isolate 0.795
investigate 0.202
escalate 0.002

Thousands of files renamed within seconds on a laptop look like ransomware, so the playbook says to isolate the machine.

Open in playground

import os import jeff with jeff.Jeff.remote("https://api.jeffhub.ai", token=os.environ["JEFF_API_KEY"], timeout_s=30) as client:     decide = client.function("jeff.security.soc.action", context={        "organisation": "A regional logistics company; this queue handles alerts from the laptops' endpoint protection.",        "playbook": "1. Ransomware behaviour (many files renamed or encrypted quickly) on any laptop: isolate the laptop.\n2. A known malicious outside address contacted: block the address.\n3. A login from a new country for an administrator: escalate.\n4. Anything else that fired: investigate.\nAllowed actions: block, isolate, escalate, investigate, ignore.",    })     decision = decide("Alert: suspicious file activity on laptop LT-0441 (user: warehouse planner).\nIn 90 seconds, 2,314 files in the user's documents folder were renamed with the extension .locked.\nProcess: an unsigned program started from the downloads folder.")     print(decision.value, decision.confidence)

More examples

Laptop calling a known bad addressblock · 1

Context

organisation: A regional logistics company; this queue handles alerts from the laptops' endpoint protection.
playbook: 1. Ransomware behaviour (many files renamed or encrypted quickly) on any laptop: isolate the laptop. 2. A known malicious outside address contacted: block the address. 3. A login from a new country for an administrator: escalate. 4. The IT team's weekly test alert (named "Weekly AV check"): ignore. 5. Anything else that fired: investigate. Allowed actions: block, isolate, escalate, investigate, ignore.

Input

Alert: outbound connection to a known malicious address from laptop LT-0517 (user: driver scheduler). Destination 198.51.100.77, listed on the threat feed as a command-and-control server since 30 October. No unusual file activity on the laptop.

Answer (JSON)

value block, confidence 1

Top options

block 1
isolate 0
escalate 0

The laptop contacted an address the threat feed lists as malicious, so the playbook says to block it.

Open in playground

import os import jeff with jeff.Jeff.remote("https://api.jeffhub.ai", token=os.environ["JEFF_API_KEY"], timeout_s=30) as client:     decide = client.function("jeff.security.soc.action", context={        "organisation": "A regional logistics company; this queue handles alerts from the laptops' endpoint protection.",        "playbook": "1. Ransomware behaviour (many files renamed or encrypted quickly) on any laptop: isolate the laptop.\n2. A known malicious outside address contacted: block the address.\n3. A login from a new country for an administrator: escalate.\n4. The IT team's weekly test alert (named \"Weekly AV check\"): ignore.\n5. Anything else that fired: investigate.\nAllowed actions: block, isolate, escalate, investigate, ignore.",    })     decision = decide("Alert: outbound connection to a known malicious address from laptop LT-0517 (user: driver scheduler).\nDestination 198.51.100.77, listed on the threat feed as a command-and-control server since 30 October.\nNo unusual file activity on the laptop.")     print(decision.value, decision.confidence)

Administrator signing in from a new countryescalate · 1

Context

organisation: A regional logistics company; this queue handles alerts from the laptops' endpoint protection.
playbook: 1. Ransomware behaviour (many files renamed or encrypted quickly) on any laptop: isolate the laptop. 2. A known malicious outside address contacted: block the address. 3. A login from a new country for an administrator: escalate. 4. The IT team's weekly test alert (named "Weekly AV check"): ignore. 5. Anything else that fired: investigate. Allowed actions: block, isolate, escalate, investigate, ignore.

Input

Alert: sign-in from a new country for an administrator account. User: it-admin-02 (domain administrator). Country: Brazil (never seen before; usual country United Kingdom). Time: 03:12. Multi-factor authentication: passed.

Answer (JSON)

value escalate, confidence 1

Top options

escalate 1
isolate 0
block 0

An administrator signed in from a country never seen before, so the playbook says to escalate.

Open in playground

import os import jeff with jeff.Jeff.remote("https://api.jeffhub.ai", token=os.environ["JEFF_API_KEY"], timeout_s=30) as client:     decide = client.function("jeff.security.soc.action", context={        "organisation": "A regional logistics company; this queue handles alerts from the laptops' endpoint protection.",        "playbook": "1. Ransomware behaviour (many files renamed or encrypted quickly) on any laptop: isolate the laptop.\n2. A known malicious outside address contacted: block the address.\n3. A login from a new country for an administrator: escalate.\n4. The IT team's weekly test alert (named \"Weekly AV check\"): ignore.\n5. Anything else that fired: investigate.\nAllowed actions: block, isolate, escalate, investigate, ignore.",    })     decision = decide("Alert: sign-in from a new country for an administrator account.\nUser: it-admin-02 (domain administrator). Country: Brazil (never seen before; usual country United Kingdom).\nTime: 03:12. Multi-factor authentication: passed.")     print(decision.value, decision.confidence)

Encoded script started from a spreadsheetanswer investigate · confidence 0.868
Context
organisation
A regional logistics company; this queue handles alerts from the laptops' endpoint protection.
playbook
1. Ransomware behaviour (many files renamed or encrypted quickly) on any laptop: isolate the laptop. 2. A known malicious outside address contacted: block the address. 3. A login from a new country for an administrator: escalate. 4. The IT team's weekly test alert (named "Weekly AV check"): ignore. 5. Anything else that fired: investigate. Allowed actions: block, isolate, escalate, investigate, ignore.
Input
Alert: suspicious script on laptop LT-0388 (user: accounts clerk). A spreadsheet opened from an email started PowerShell with an encoded command. No outside address on the threat feed was contacted, and no files were renamed or encrypted.
Answer (JSON)
value investigate, confidence 0.868
Top options
investigate 0.868
ignore 0.131
isolate 0
A spreadsheet started an encoded script, which matches none of the playbook's earlier rules, so the action is investigate.
Open in playground
import os import jeff with jeff.Jeff.remote("https://api.jeffhub.ai", token=os.environ["JEFF_API_KEY"], timeout_s=30) as client: decide = client.function("jeff.security.soc.action", context={ "organisation": "A regional logistics company; this queue handles alerts from the laptops' endpoint protection.", "playbook": "1. Ransomware behaviour (many files renamed or encrypted quickly) on any laptop: isolate the laptop.\n2. A known malicious outside address contacted: block the address.\n3. A login from a new country for an administrator: escalate.\n4. The IT team's weekly test alert (named \"Weekly AV check\"): ignore.\n5. Anything else that fired: investigate.\nAllowed actions: block, isolate, escalate, investigate, ignore.", }) decision = decide("Alert: suspicious script on laptop LT-0388 (user: accounts clerk).\nA spreadsheet opened from an email started PowerShell with an encoded command. No outside address on the threat feed was contacted, and no files were renamed or encrypted.") print(decision.value, decision.confidence)

The weekly test alertignore · 1

Context

organisation: A regional logistics company; this queue handles alerts from the laptops' endpoint protection.
playbook: 1. Ransomware behaviour (many files renamed or encrypted quickly) on any laptop: isolate the laptop. 2. A known malicious outside address contacted: block the address. 3. A login from a new country for an administrator: escalate. 4. The IT team's weekly test alert (named "Weekly AV check"): ignore. 5. Anything else that fired: investigate. Allowed actions: block, isolate, escalate, investigate, ignore.

Input

Alert: test file detected on laptop LT-0001 (user: it-support). Name: Weekly AV check. File: av_test_sample.txt, quarantined. Created by the IT team's scheduled task "weekly-av-test".

Answer (JSON)

value ignore, confidence 1

Top options

ignore 1
escalate 0
isolate 0

The alert is the IT team's own weekly test, which the playbook says to ignore.

Open in playground

import os import jeff with jeff.Jeff.remote("https://api.jeffhub.ai", token=os.environ["JEFF_API_KEY"], timeout_s=30) as client:     decide = client.function("jeff.security.soc.action", context={        "organisation": "A regional logistics company; this queue handles alerts from the laptops' endpoint protection.",        "playbook": "1. Ransomware behaviour (many files renamed or encrypted quickly) on any laptop: isolate the laptop.\n2. A known malicious outside address contacted: block the address.\n3. A login from a new country for an administrator: escalate.\n4. The IT team's weekly test alert (named \"Weekly AV check\"): ignore.\n5. Anything else that fired: investigate.\nAllowed actions: block, isolate, escalate, investigate, ignore.",    })     decision = decide("Alert: test file detected on laptop LT-0001 (user: it-support).\nName: Weekly AV check. File: av_test_sample.txt, quarantined. Created by the IT team's scheduled task \"weekly-av-test\".")     print(decision.value, decision.confidence)

Use when

Your security operations team has a written playbook defining rule order, thresholds, assets and allowed actions.
Analysts should review uncertain alerts based on their probabilities.

Avoid when

You need to detect threats outside the supplied playbook; this adapter applies the rules provided.
The assessment requires several events to be considered together.
You plan commercial use; the adapter is licensed CC BY-NC 4.0 (non-commercial use only), because its training data includes non-commercial and all-rights-reserved sources.

Context and input

Field	Kind	Description
alert	input	The new alert as the security tools report it - what fired, on which host or user, the evidence and any lookups.
organisation	context	One line on the organisation, its sector and which alert source this queue handles.
playbook	context	The playbook: numbered rules (the first that matches decides), thresholds, severity table, asset inventory or office policy, allowed actions, and what to do when a rule calls for an action the team may not take.

Functions

Key	Interface	Instructions	Labels
action	classify	You are the first-line analyst in a security operations centre. Apply the organisation's playbook to the new alert and choose the action the playbook requires. The playbook's rules are checked in order and the first rule that matches decides.	block, isolate, escalate, investigate, ignore

How it was measured

Test accuracy: the share of test rows whose top answer was right.

95.6% on the held-out test (4,929 rows). test-set kind not recorded

When confident

From the calibration set: at or above the threshold confidence, how often the answer is right, and how often the adapter is that confident. Below it, escalate.

Function	Right when confident	Confident on	Threshold	Calibration rows
action	98.0%	95.9%	0.73	991

Base: Jeff v1.4. Adapter trained: 25 October 2026.

Base

jeff-base v1.4

Call it

jeff.security.soc.action, with placeholders for its input and context.

import os import jeff with jeff.Jeff.remote("https://api.jeffhub.ai", token=os.environ["JEFF_API_KEY"], timeout_s=30) as client:     decide = client.function("jeff.security.soc.action", context={        "organisation": "<organisation>",        "playbook": "<playbook>",    })     decision = decide("<alert>")     print(decision.value, decision.confidence)

Download

Weights: mstrasser/jeff-adapter-soc (v1.4)

Licence: CC-BY-NC-4.0