Use cases· Last updated 2026-09-21

Security decision workflow with Jev

SIEM, EDR, and SOAR already detect and can isolate. Jev judges whether the alert narrative + evidence pack is enough and whether policy allows the proposed contain class. Code aborts auto-containment unless those atoms clear. Jev does not match IOCs, isolate hosts, or write detections.

This unofficial page is the decision workflow slice of the security containment-abort pack. Intent: apply the Jev (TypeSafe System One) decision model to security containment-abort decision workflow. Primary search language: Security Jev decision workflow. Confirm patterns on docs.typesafe.ai. This site does not sell, issue, or proxy TypeSafe keys. Use a credential you already have from the console or a documented gateway.

Independent angle (cover ≠ clone): Evidence-sufficiency + policy-allow + abort thresholds before SOAR fires isolate/disable — not a clone of support-action recipes, LLM guardrail Noul screens, or SRE incident SEV classification.

Security use-case context

Security containment-abort is a workflow, not a chat and not a WAF. Assemble a narrow state, ask the primitives below, and let the abort gate branch. TypeSafe’s docs say a good question is a snap decision a knowledgeable person could make in a few seconds — not an open-ended analysis of the alert + evidence pack.

Hub: Use cases. Compare, when the other tool is the real job: security automation. Key handling and fail-closed around Jev itself: security guide.

Decision Workflow inputs

Keep only fields the questions name:

{
  "alert": { "id": "SOC-1902", "text": "Impossible travel + new OAuth grant on finance-sso; user says travel is unexpected." },
  "asset": { "tier": "prod-idp", "owner": "identity" },
  "evidence": { "ioc_hits": 0, "enrichment_ok": true, "summary": "No hash match. New grant to unknown app. Last login US-East 40m earlier." },
  "policy": { "isolate": "Auto-isolate only if evidence_ok and asset.tier is not shared-idp.", "evidence_min": "Need either IOC hit or named user contradiction plus enrichment_ok." }
}

Point instructions at alert.text, evidence.summary, policy.isolate, policy.evidence_min, asset.tier. Drop PCAP, malware bytes, raw memory dumps, and the week’s SIEM histogram.

Decision signals and actions

All of these share state and run in parallel. Code owns the abort graph:

def contain_gate(ans, ioc_hits, enrichment_ok, asset_tier):
    if not enrichment_ok:
        return "abort_enrich"          # code — gather failed
    if ioc_hits >= 1 and asset_tier != "shared-idp":
        return "soar_isolate"          # deterministic IOC path; skip Jev
    if ans["evidence_ok"].noul < T_EVIDENCE:
        return "abort_thin_evidence"
    cls = ans["contain_class"]
    if cls.confidence < FLOOR or cls.choice == "other":
        return "analyst_queue"
    if ans["policy_allow"].noul < T_POLICY:
        return "abort_policy"
    if cls.choice in ("isolate_host", "disable_cred") and asset_tier == "shared-idp":
        return "abort_shared_idp"      # code policy
    return f"soar:{cls.choice}"

Do not treat a Noul of 0.5 as a “medium” security containment-abort score — it means yes and no are equally likely. Conjunctions stay in your code.

Guardrails and escalation

TypeSafe’s confidence-gated examples use a lower bar for recoverable reads than for irreversible actions. Those numbers are illustrations. For security containment-abort, treat auto_isolate_host as the high bar (isolating a host or disabling a credential). Tune on labels — see offline evaluation.

Low confidence, thin evidence, or a policy miss → abort to analyst; do not isolate or disable from Jev alone. IOC-positive hosts can still take the deterministic SOAR path in code.

Evaluation and rollout notes

Shadow: SOAR plays unchanged; log Jev contain_class + abort reason.

Canary: Auto-tag ticket_only on one detector family; isolate/disable stay human or IOC-deterministic.

Pin jev-1.13.0 (the versioned id) after you fit thresholds. jev-latest and the marketing line jev-1.13 can move. Log the response model. TypeSafe’s published list price for jev-1.13 is $0.042 per million input tokens (vendor claim — confirm on the models page); output tokens are free on that same page. Unused distractors still bill as input.

Official Python and JavaScript SDKs read TYPESAFE_API_KEY and retry documented 429/529. This site does not sell, issue, or proxy TypeSafe keys. Use a credential you already have from the console or a documented gateway.

Pack map

FAQ

Does Jev execute the SOAR action? No. It returns typed answers. Your abort-gate code calls SOAR, tickets, or humans.

Why several questions in one request? TypeSafe’s fan-out pattern: extra questions are cheap versus another HTTP call. contain_class + evidence_ok + policy_allow in one call per alert. IOC matching stays in the SIEM.

Where is the rest of the Security pack? Start with Security input contracts and Security confidence thresholds. Cluster hub: Use cases.

Is this the LLM guardrails cookbook? No. Guardrails screen prompts and completions. This pack aborts containment when evidence or policy is thin. See LLM guardrails.

If IOC hits are already ≥ 1, should we wait for Jev? No. Deterministic contain wins. Jev is for leftover messy narrative.

What this page does not claim

• Not a SIEM, SOAR, EDR, or certified safety filter.
• No MTTD / MTTC benchmarks.
• Not official TypeSafe.
• Official TypeSafe status, or that jev.pro issues API keys.
• That a schema-constrained answer is automatically factually correct.

Disclaimer

This is an independent unofficial site and is not affiliated with TypeSafe AI; official documentation is available at https://docs.typesafe.ai.

Primary documentation: https://docs.typesafe.ai. Hub: Use cases.