# Process a JSONL file of structured behavioral events
node dist/cybercore_zero_standalone.cjs \
  --input=events.jsonl \
  --format=zero \
  --output=alerts.jsonl \
  --state=state.db

# Process Windows Event Log (EVTX) events
node dist/cybercore_zero_standalone.cjs \
  --input=windows_events.jsonl \
  --format=winevent \
  --output=alerts.jsonl \
  --state=state.db

# Formats: zero (native), winevent (Windows Security + Sysmon)
# State DB persists actor state across runs (SQLite via sql.js)

// Structured Behavioral Event (native format)
{
  "actor_id": "alice@corp.example",      // Unique actor identifier
  "actor_type": "user",                   // user | process | system | network
  "event_type": "login",                  // Domain-specific event type
  "timestamp": 1700000000000,             // Unix milliseconds (UTC)
  "domain_hint": "user_behavior",         // Optional: override domain classification
  "context": {
    "environment_class": "production",    // Optional: production | staging | dev
    "source_ip": "10.0.0.1",
    "target_resource": "/api/admin"
  }
}

Full synthetic simulation: 352,582 events across 2015–2025, 1,100 actors, 8 named threat actor campaigns, 4 insider cases. Deterministic (seed 42) — same inputs produce the same alerts and the same SHA-256 hash every time. No network. No real data. Results are reproducible by anyone.

Use this to permit a transition that the built-in rule table does not cover. Example: in your environment, cmd.exe legitimately connects to the network — add process_behavior:running → process_behavior:communicating for that actor class.

The engine's 74 built-in transition rules cover the most common legitimate behavioural sequences. In your specific environment, some additional sequences may be legitimate. Adding a custom rule tells the engine to permit that transition for all actors in the specified domain.

Custom rules are stored in the database and loaded on engine restart. They are auditable — every rule has a creation timestamp and can be toggled or deleted. They do not modify the built-in rule table.

⚠ Adding a rule reduces sensitivity. Only add rules for transitions you have confirmed are legitimate in your environment.

By default, perpetual enrolment is active — new actors are always silently enrolled. You can override this with a fixed time window (e.g. for a controlled evaluation environment), or disable enrolment entirely. Set to 0 to disable immediately. Disabling on a live network will produce false positives for every new actor.

Enter an Alert ID to generate a plain-English incident report using AI. Reports are cached and persist across sessions.

Paste your environment data as JSON. Each field accepts either a flat array or a structured object. A sample format is shown in each field.

Review each detected shadow privilege. For each one, decide: Clean (remove from configuration) or Accept (document and retain with justification).

Assign each discovered action to a permitted corridor. This defines what sequences of behaviour are structurally allowed for each actor type.