The instrument.

How it works

01 CREATE A TENANT

One call, get a key. Free tier is 1,000 events, no card.

02 STREAM LOG LINES

POST /platform/ingest with your X-API-Key.

03 READ THE VERDICT

Score, components, classes, hit counts. Flagged events surface in your alerts feed.

The verdict, dissected

{
  "verdicts": [{
    "event_id": "ev-0001",
    "score": 46.2,
    "components": {
      "vocabulary": 24.0, "phrases": 16.7,
      "structures": 5.5, "morphology": 0.0
    },
    "matched_behaviors": [
      "EXTERNAL_STATE_PERSISTENCE",
      "UNREGISTERED_COMMUNICATION"
    ],
    "vocab_hits": 4, "phrase_hits": 2,
    "flagged": true
  }]
}

score: The composite verdict for the event.
components: Our published scoring axes: vocabulary, phrases, structures, morphology.
matched_behaviors: The behavior class names that matched.
vocab_hits / phrase_hits: How many times each axis registered.
flagged: Whether the event enters your alerts feed.

Alerts

worker-7 · flagged · score 46.2 · 2 classes matched
planner-2 · flagged · score 38.9 · 1 class matched
worker-3 · flagged · score 51.4 · 3 classes matched
retriever-1 · flagged · score 33.1 · 1 class matched

THE BOUNDARY, AGAIN

Your telemetry never enters our research store. It is never searched by anyone but you. And the ruleset never leaves our servers — customers receive verdicts, not our method.