provenance-graph

Engram — a trust layer for agent memory. Memories are claims with a lifecycle and a provenance graph; retrieval ranks by similarity x earned trust; quarantine cascades through graphLookup.

Sample-to-story malware analysis: CAPEv2/Sysmon report replay into provenance graphs and ATT&CK timelines, family attribution, and single-run Sigma/YARA synthesis with measured sibling recall and cross-family/benign FPR; standalone explainable EMBER gate. Lab-only, never executes samples.

🗺️ Interactive visual atlas dissecting APT lifecycles, causal provenance graphs, and detection telemetry.

Forensic timeline reconstruction from GUID-less artefacts: calibrated causal rules, confidence-graded incident stories and SHA-256 custody (Sysmon/EVTX, plaso, Volatility, auth.log, auditd). Lab-only DFIR.

Explainable provenance-graph attack reconstruction: time-respecting backtracking ablated on ATLAS with held-out host logs, a bpftrace probe run live in CI, Sysmon/auditd/ATLAS loaders, STIX/Neo4j export.

Evidence-first security knowledge graph: 13 security tools write reliability-graded claims into one graph, and fusing only independent engines ranks the true ATT&CK technique first more often and makes confident attribution right more often - measured with intervals on OTRF, APT29 and ATT&CK data