Skip to content

Commit a721588

Browse files
authored
Merge pull request #17 from stacknil/codex/docs-public-presentation
docs: strengthen public presentation and add minimal community health files
2 parents 973488b + a3236df commit a721588

9 files changed

Lines changed: 271 additions & 82 deletions

File tree

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Bug report
2+
description: Report a reproducible problem in the repository's current behavior
3+
title: "[Bug]: "
4+
body:
5+
- type: textarea
6+
id: summary
7+
attributes:
8+
label: What happened?
9+
description: Describe the problem in one or two clear sentences.
10+
placeholder: The default sample run writes alerts.csv, but summary.json is missing.
11+
validations:
12+
required: true
13+
14+
- type: textarea
15+
id: reproduce
16+
attributes:
17+
label: How do we reproduce it?
18+
description: Include the exact command, config, input path, and any relevant output.
19+
placeholder: |
20+
1. Run `python -m telemetry_window_demo.cli run --config configs/default.yaml`
21+
2. Inspect `data/processed/`
22+
3. Observe ...
23+
validations:
24+
required: true
25+
26+
- type: textarea
27+
id: expected
28+
attributes:
29+
label: What did you expect?
30+
placeholder: summary.json should be written alongside the CSV outputs.
31+
32+
- type: input
33+
id: environment
34+
attributes:
35+
label: Environment
36+
description: OS, Python version, and anything else relevant.
37+
placeholder: Windows 11, Python 3.12

.github/ISSUE_TEMPLATE/config.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
blank_issues_enabled: false
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: Feature request
2+
description: Suggest a small improvement or next demo for the repository
3+
title: "[Feature]: "
4+
body:
5+
- type: textarea
6+
id: proposal
7+
attributes:
8+
label: What would you like to add or improve?
9+
description: Keep it concrete and close to the repository's current scope.
10+
placeholder: Add a host-centric investigation demo that reuses the current sample outputs.
11+
validations:
12+
required: true
13+
14+
- type: textarea
15+
id: why
16+
attributes:
17+
label: Why does it help?
18+
description: Explain how this improves the demo, docs, or portfolio narrative.
19+
placeholder: It would make the rule outputs easier to connect to an analyst workflow.
20+
validations:
21+
required: true
22+
23+
- type: textarea
24+
id: scope
25+
attributes:
26+
label: Scope guardrails
27+
description: Call out anything this request should not turn into.
28+
placeholder: Keep it file-based; no hosted dashboard or alert-routing work.

.github/pull_request_template.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
## Summary
2+
3+
- what changed
4+
- why it changed
5+
6+
## Validation
7+
8+
- [ ] `pytest`
9+
- [ ] README or docs updated if behavior, commands, or outputs changed
10+
11+
## Scope Check
12+
13+
- [ ] Small coherent change
14+
- [ ] No production-readiness claims added

CONTRIBUTING.md

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Contributing
2+
3+
Thanks for the interest. This is a solo-maintainer portfolio repository, so the most helpful contributions are small, scoped, and easy to review.
4+
5+
## Good Contributions
6+
7+
- bug reports with exact commands, configs, and sample inputs
8+
- docs fixes when README behavior drifts from the actual CLI
9+
- small tests around time parsing, window boundaries, and alert thresholds
10+
- narrowly scoped pull requests that keep the repository local and file-based
11+
12+
## Before Opening A Pull Request
13+
14+
- keep the project boundary honest: this is not a production monitoring system
15+
- prefer fixing or clarifying existing behavior over adding large new subsystems
16+
- update README or docs if a user-visible command, output, or artifact changes
17+
- run:
18+
19+
```bash
20+
python -m pip install -e .
21+
pytest
22+
```
23+
24+
If you want to propose a larger demo or roadmap item, opening an issue first is the easiest path.

README.md

Lines changed: 90 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -2,72 +2,25 @@
22

33
[![CI](https://github.com/stacknil/telemetry-lab/actions/workflows/ci.yml/badge.svg)](https://github.com/stacknil/telemetry-lab/actions/workflows/ci.yml)
44

5-
Latest release: [v0.3.0](https://github.com/stacknil/telemetry-lab/releases/tag/v0.3.0) adds more precise cooldown scoping, a richer bundled scenario pack, and machine-readable run summaries for reusable local demos.
6-
7-
Small prototypes for telemetry analytics, monitoring, and detection-oriented signal processing.
8-
9-
## Current demo
10-
11-
`telemetry-window-demo` turns timestamped event streams into sliding-window telemetry features, simple rule-based alerts, and operator-friendly CSV and PNG outputs.
12-
13-
## MVP workflow
14-
15-
1. Install the package and its minimal dependencies:
16-
17-
```bash
18-
python -m pip install -e .
19-
```
20-
21-
2. Run the bundled sample pipeline end-to-end:
22-
23-
```bash
24-
python -m telemetry_window_demo.cli run --config configs/default.yaml
25-
```
26-
27-
The sample config reads `data/raw/sample_events.jsonl` and regenerates outputs in `data/processed/`.
28-
29-
For a richer scenario pack that is easier to walk through in demos:
5+
Small portfolio prototypes for telemetry analytics, monitoring, and detection-oriented signal processing.
306

31-
```bash
32-
python -m telemetry_window_demo.cli run --config configs/richer_sample.yaml
33-
```
7+
## What This Repo Is
348

35-
That scenario pack reads `data/raw/richer_sample_events.jsonl` and writes outputs to `data/processed/richer_sample/`.
36-
It currently produces `28` normalized events, `24` windows, and `8` alerts.
37-
Both sample paths also emit a compact `summary.json` alongside the CSV and PNG outputs.
38-
39-
## Current behavior
40-
41-
Default sample input:
42-
43-
- JSONL event stream under `data/raw/sample_events.jsonl`
44-
45-
Runtime input support:
46-
47-
- `.jsonl` (default sample/demo format)
48-
- `.csv` (also supported by the loader)
49-
50-
Required fields for both formats on every row/record:
51-
52-
- `timestamp`
53-
- `event_type`
54-
- `source`
55-
- `target`
56-
- `status`
57-
58-
With the bundled sample data, the default run currently produces:
9+
`telemetry-window-demo` is a local Python CLI that turns timestamped event streams into:
5910

60-
- `41` normalized events
61-
- `24` windows
62-
- `12` alerts after applying a `60` second cooldown
11+
- sliding-window feature tables
12+
- cooldown-reduced rule-based alerts
13+
- PNG timeline plots
14+
- machine-readable run summaries
6315

64-
The default config suppresses repeated alerts by cooldown key. The key is `rule_name` plus an entity scope when the rule input includes `entity`, `source`, `target`, or `host`; otherwise it falls back to `rule_name` alone. Different cooldown keys can still alert on the same window.
16+
## Quick Run
6517

66-
The richer scenario pack uses a longer `120` second cooldown so the output stays compact enough to inspect as four phases: normal background activity, a login-failure burst, a high-risk configuration change with follow-on policy denials, and a rare malware-alert repeat sequence.
67-
68-
## Outputs
69-
70-
Running the default command regenerates:
18+
```bash
19+
python -m pip install -e .
20+
python -m telemetry_window_demo.cli run --config configs/default.yaml
21+
```
22+
23+
That command reads `data/raw/sample_events.jsonl` and regenerates:
7124

7225
- `data/processed/features.csv`
7326
- `data/processed/alerts.csv`
@@ -76,16 +29,79 @@ Running the default command regenerates:
7629
- `data/processed/error_rate_timeline.png`
7730
- `data/processed/alerts_timeline.png`
7831

79-
The summary artifact includes the input path, output directory, normalized event count, window count, feature row count, alert count, triggered rule names and counts, cooldown setting, and generated artifact paths.
80-
81-
## Scope
82-
83-
This repository is a portfolio prototype, not a production monitoring system.
84-
85-
## Limitations
86-
87-
- No real-time ingestion
88-
- No streaming state management
89-
- No alert routing or case management
90-
- No dashboard or service deployment
91-
- Sample-data driven only
32+
With the bundled default sample, the current repo state produces:
33+
34+
- `41` normalized events
35+
- `24` windows
36+
- `12` alerts after a `60` second cooldown
37+
38+
Why it is worth a quick look:
39+
40+
- it shows a full telemetry path from raw events to operator-facing outputs
41+
- the sample inputs and outputs are reproducible in-repo
42+
- a second bundled scenario gives a slightly richer walkthrough without changing the basic CLI flow
43+
44+
![Default alert timeline](data/processed/alerts_timeline.png)
45+
46+
## Demo Variants
47+
48+
Default sample:
49+
50+
- config: [`configs/default.yaml`](configs/default.yaml)
51+
- input: `data/raw/sample_events.jsonl`
52+
- outputs: `data/processed/`
53+
- current summary: `41` events, `24` windows, `12` alerts, `summary.json` included
54+
55+
Richer sample:
56+
57+
- config: [`configs/richer_sample.yaml`](configs/richer_sample.yaml)
58+
- input: `data/raw/richer_sample_events.jsonl`
59+
- outputs: `data/processed/richer_sample/`
60+
- current summary: `28` events, `24` windows, `8` alerts, `summary.json` included
61+
62+
## Input Support
63+
64+
Runtime input support:
65+
66+
- `.jsonl`
67+
- `.csv`
68+
69+
Required fields for both formats on every row or record:
70+
71+
- `timestamp`
72+
- `event_type`
73+
- `source`
74+
- `target`
75+
- `status`
76+
77+
Cooldown behavior:
78+
79+
- repeated alerts are keyed by `(rule_name, scope)`
80+
- scope prefers the first available entity-like field in this order: `entity`, `source`, `target`, `host`
81+
- when no entity-like field is present, cooldown falls back to per-`rule_name` behavior
82+
83+
## Repo Guide
84+
85+
- [`docs/sample-output.md`](docs/sample-output.md) summarizes the committed sample artifacts
86+
- [`docs/roadmap.md`](docs/roadmap.md) sketches the next demo directions
87+
- [`data/processed/summary.json`](data/processed/summary.json) captures the default run in machine-readable form
88+
- [`data/processed/richer_sample/summary.json`](data/processed/richer_sample/summary.json) captures the richer scenario pack
89+
- [`tests/`](tests/) keeps regression coverage close to the CLI behavior and windowing logic
90+
91+
## Next Demo Directions
92+
93+
- strengthen JSONL and CSV validation so ingestion failures are clearer
94+
- keep reducing repeated alert noise while preserving simple rule-based behavior
95+
- keep sample-output docs and public repo presentation aligned with the checked-in demo state
96+
97+
## Scope
98+
99+
This repository is a portfolio prototype, not a production monitoring system.
100+
101+
## Limitations
102+
103+
- No real-time ingestion
104+
- No streaming state management
105+
- No alert routing or case management
106+
- No dashboard or service deployment
107+
- Sample-data driven only

SECURITY.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Security Policy
2+
3+
This repository is a local, sample-data portfolio prototype. It is not a hosted service and does not come with production security guarantees.
4+
5+
## Reporting A Vulnerability
6+
7+
Please avoid posting secrets, credentials, or detailed exploit steps in a public issue.
8+
9+
- If GitHub private vulnerability reporting is available for this repository, use it for sensitive reports.
10+
- Otherwise, open a minimal public issue that omits exploit details and asks for a private follow-up path.
11+
12+
## What Is In Scope
13+
14+
Useful reports are issues that could affect local file handling, sample-data processing, dependency safety, or accidental credential exposure in the repository.

docs/roadmap.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Roadmap
2+
3+
This repository is intentionally small, so the next steps should be new demos that make the existing telemetry pipeline easier to understand rather than a broad platform build-out.
4+
5+
## 1. Auth/Login Anomaly Triage Demo
6+
7+
Goal:
8+
Add a demo that walks from bursty login failures into follow-on signals such as source spread, eventual success, or repeated target concentration.
9+
10+
Why it helps the portfolio:
11+
This strengthens the repo's analyst-facing story. It shows how simple window features and rule output can support a concrete triage narrative instead of stopping at generic alert generation.
12+
13+
## 2. Rule Evaluation And Dedup Demo
14+
15+
Goal:
16+
Add a demo or explainer that makes rule matches, cooldown behavior, and alert suppression easier to inspect side by side.
17+
18+
Why it helps the portfolio:
19+
This makes the repository's alert semantics more legible. It shows that the project is not only producing alerts, but also exposing how repeated windows become fewer, more explainable notifications.
20+
21+
## 3. Config-Change Investigation Demo
22+
23+
Goal:
24+
Add a compact scenario centered on risky configuration changes, follow-on policy denials, and a short machine-readable investigation summary.
25+
26+
Why it helps the portfolio:
27+
This broadens the repo beyond auth-only behavior while staying inside the same local, file-based pipeline. It gives the project a second clear demo narrative that is still easy to explain from committed sample data.

docs/sample-output.md

Lines changed: 36 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,51 @@
11
# Sample Output
22

3-
Running the default pipeline produces:
3+
The committed sample artifacts are intended to be reproducible from the bundled inputs and configs.
4+
5+
## Default Sample
6+
7+
Running `python -m telemetry_window_demo.cli run --config configs/default.yaml` produces:
48

59
- a window feature table at `data/processed/features.csv`
610
- an alert table at `data/processed/alerts.csv`
11+
- a machine-readable summary at `data/processed/summary.json`
712
- three timeline plots under `data/processed/`
813

9-
On the bundled sample dataset, the default config produces:
14+
On the bundled default sample dataset, the current repo state produces:
1015

11-
- `41` input events
16+
- `41` normalized events
1217
- `24` sliding windows
13-
- `53` alerts across rule categories
18+
- `12` alerts after a `60` second cooldown
19+
20+
The default summary currently reports these triggered rule counts:
21+
22+
- `high_error_rate`: `3`
23+
- `persistent_high_error`: `3`
24+
- `high_severity_spike`: `2`
25+
- `login_fail_burst`: `2`
26+
- `source_spread_spike`: `1`
27+
- `rare_event_repeat_malware_alert`: `1`
28+
29+
## Richer Sample
1430

15-
The sample is intentionally bursty so the plots and alerts are visually obvious in a portfolio setting.
31+
Running `python -m telemetry_window_demo.cli run --config configs/richer_sample.yaml` produces:
32+
33+
- a window feature table at `data/processed/richer_sample/features.csv`
34+
- an alert table at `data/processed/richer_sample/alerts.csv`
35+
- a machine-readable summary at `data/processed/richer_sample/summary.json`
36+
- three timeline plots under `data/processed/richer_sample/`
37+
38+
On the richer bundled sample dataset, the current repo state produces:
39+
40+
- `28` normalized events
41+
- `24` sliding windows
42+
- `8` alerts after a `120` second cooldown
1643

17-
Representative alert categories in the sample dataset:
44+
Representative alert categories across the bundled samples:
1845

1946
- elevated error rate during the login failure burst
2047
- repeated high-severity events around `malware_alert`
21-
- sudden source spread as the number of distinct sources increases
48+
- sudden source spread as the number of distinct sources increases in the default sample
49+
- repeated rare-event alerts for both `malware_alert` and `policy_denied` in the richer sample
2250

23-
See the generated assets in `assets/` for README-friendly screenshots.
51+
See the committed PNGs under `data/processed/` and `data/processed/richer_sample/` for GitHub-visible output snapshots.

0 commit comments

Comments
 (0)