You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Latest release: [v0.3.0](https://github.com/stacknil/telemetry-lab/releases/tag/v0.3.0) adds more precise cooldown scoping, a richer bundled scenario pack, and machine-readable run summaries for reusable local demos.
6
-
7
-
Small prototypes for telemetry analytics, monitoring, and detection-oriented signal processing.
8
-
9
-
## Current demo
10
-
11
-
`telemetry-window-demo` turns timestamped event streams into sliding-window telemetry features, simple rule-based alerts, and operator-friendly CSV and PNG outputs.
12
-
13
-
## MVP workflow
14
-
15
-
1. Install the package and its minimal dependencies:
16
-
17
-
```bash
18
-
python -m pip install -e .
19
-
```
20
-
21
-
2. Run the bundled sample pipeline end-to-end:
22
-
23
-
```bash
24
-
python -m telemetry_window_demo.cli run --config configs/default.yaml
25
-
```
26
-
27
-
The sample config reads `data/raw/sample_events.jsonl` and regenerates outputs in `data/processed/`.
28
-
29
-
For a richer scenario pack that is easier to walk through in demos:
5
+
Small portfolio prototypes for telemetry analytics, monitoring, and detection-oriented signal processing.
30
6
31
-
```bash
32
-
python -m telemetry_window_demo.cli run --config configs/richer_sample.yaml
33
-
```
7
+
## What This Repo Is
34
8
35
-
That scenario pack reads `data/raw/richer_sample_events.jsonl` and writes outputs to `data/processed/richer_sample/`.
36
-
It currently produces `28` normalized events, `24` windows, and `8` alerts.
37
-
Both sample paths also emit a compact `summary.json` alongside the CSV and PNG outputs.
38
-
39
-
## Current behavior
40
-
41
-
Default sample input:
42
-
43
-
- JSONL event stream under `data/raw/sample_events.jsonl`
44
-
45
-
Runtime input support:
46
-
47
-
-`.jsonl` (default sample/demo format)
48
-
-`.csv` (also supported by the loader)
49
-
50
-
Required fields for both formats on every row/record:
51
-
52
-
-`timestamp`
53
-
-`event_type`
54
-
-`source`
55
-
-`target`
56
-
-`status`
57
-
58
-
With the bundled sample data, the default run currently produces:
9
+
`telemetry-window-demo` is a local Python CLI that turns timestamped event streams into:
59
10
60
-
-`41` normalized events
61
-
-`24` windows
62
-
-`12` alerts after applying a `60` second cooldown
11
+
- sliding-window feature tables
12
+
- cooldown-reduced rule-based alerts
13
+
- PNG timeline plots
14
+
- machine-readable run summaries
63
15
64
-
The default config suppresses repeated alerts by cooldown key. The key is `rule_name` plus an entity scope when the rule input includes `entity`, `source`, `target`, or `host`; otherwise it falls back to `rule_name` alone. Different cooldown keys can still alert on the same window.
16
+
## Quick Run
65
17
66
-
The richer scenario pack uses a longer `120` second cooldown so the output stays compact enough to inspect as four phases: normal background activity, a login-failure burst, a high-risk configuration change with follow-on policy denials, and a rare malware-alert repeat sequence.
67
-
68
-
## Outputs
69
-
70
-
Running the default command regenerates:
18
+
```bash
19
+
python -m pip install -e .
20
+
python -m telemetry_window_demo.cli run --config configs/default.yaml
21
+
```
22
+
23
+
That command reads `data/raw/sample_events.jsonl` and regenerates:
71
24
72
25
-`data/processed/features.csv`
73
26
-`data/processed/alerts.csv`
@@ -76,16 +29,79 @@ Running the default command regenerates:
76
29
-`data/processed/error_rate_timeline.png`
77
30
-`data/processed/alerts_timeline.png`
78
31
79
-
The summary artifact includes the input path, output directory, normalized event count, window count, feature row count, alert count, triggered rule names and counts, cooldown setting, and generated artifact paths.
80
-
81
-
## Scope
82
-
83
-
This repository is a portfolio prototype, not a production monitoring system.
84
-
85
-
## Limitations
86
-
87
-
- No real-time ingestion
88
-
- No streaming state management
89
-
- No alert routing or case management
90
-
- No dashboard or service deployment
91
-
- Sample-data driven only
32
+
With the bundled default sample, the current repo state produces:
33
+
34
+
-`41` normalized events
35
+
-`24` windows
36
+
-`12` alerts after a `60` second cooldown
37
+
38
+
Why it is worth a quick look:
39
+
40
+
- it shows a full telemetry path from raw events to operator-facing outputs
41
+
- the sample inputs and outputs are reproducible in-repo
42
+
- a second bundled scenario gives a slightly richer walkthrough without changing the basic CLI flow
This repository is a local, sample-data portfolio prototype. It is not a hosted service and does not come with production security guarantees.
4
+
5
+
## Reporting A Vulnerability
6
+
7
+
Please avoid posting secrets, credentials, or detailed exploit steps in a public issue.
8
+
9
+
- If GitHub private vulnerability reporting is available for this repository, use it for sensitive reports.
10
+
- Otherwise, open a minimal public issue that omits exploit details and asks for a private follow-up path.
11
+
12
+
## What Is In Scope
13
+
14
+
Useful reports are issues that could affect local file handling, sample-data processing, dependency safety, or accidental credential exposure in the repository.
This repository is intentionally small, so the next steps should be new demos that make the existing telemetry pipeline easier to understand rather than a broad platform build-out.
4
+
5
+
## 1. Auth/Login Anomaly Triage Demo
6
+
7
+
Goal:
8
+
Add a demo that walks from bursty login failures into follow-on signals such as source spread, eventual success, or repeated target concentration.
9
+
10
+
Why it helps the portfolio:
11
+
This strengthens the repo's analyst-facing story. It shows how simple window features and rule output can support a concrete triage narrative instead of stopping at generic alert generation.
12
+
13
+
## 2. Rule Evaluation And Dedup Demo
14
+
15
+
Goal:
16
+
Add a demo or explainer that makes rule matches, cooldown behavior, and alert suppression easier to inspect side by side.
17
+
18
+
Why it helps the portfolio:
19
+
This makes the repository's alert semantics more legible. It shows that the project is not only producing alerts, but also exposing how repeated windows become fewer, more explainable notifications.
20
+
21
+
## 3. Config-Change Investigation Demo
22
+
23
+
Goal:
24
+
Add a compact scenario centered on risky configuration changes, follow-on policy denials, and a short machine-readable investigation summary.
25
+
26
+
Why it helps the portfolio:
27
+
This broadens the repo beyond auth-only behavior while staying inside the same local, file-based pipeline. It gives the project a second clear demo narrative that is still easy to explain from committed sample data.
0 commit comments