Jevline

DFIR triage tool that starts from a single confirmed-malicious process, host, account or address and walks telemetry — process lineage, injection, dropped files, network contacts and logons — scoring whether each linked artifact belongs to the same incident. Produces an incident membership list, timeline, execution chain and evidence table, and runs as a dependency-free TypeScript CLI or a hosted web UI. The author labels it experimental triage that still needs analyst review.