Skip to content
Agent Archaeology

Project

Telltale

Telltale is an open-source detection layer for AI coding agents. It scans agent session stores, normalizes tool activity, detects risky patterns, and emits redacted JSONL telemetry for investigation and SIEM workflows.

How it works

Point Telltale at your agent session stores. It discovers supported clients, parses transcripts into a normalized event model, applies YAML-defined detection rules, scores activity across session windows, and writes redacted JSONL telemetry. Forward that telemetry to Splunk or another SIEM for alerting, dashboards, and investigation.

Supported agents

Telltale can parse multiple agent source shapes, but validation depth varies. Codex and OpenCode have the strongest validation. Claude Code, GitHub Copilot, and Gemini CLI have some real-world validation. Qwen CLI, RooCode, KiloCode, and OpenClaw are primarily fixture-backed today.

Artifact Paths

Codex

JSONL sessions, archived sessions, headless sessions. Highest confidence.

OpenCode

SQLite database and legacy JSON. Highest confidence.

Claude Code

JSONL project sessions. Medium confidence.

GitHub Copilot

Process logs. Medium confidence.

Gemini CLI

JSON session files. Medium-low confidence.

Qwen CLI

JSONL project chats. Fixture-backed.

RooCode

VS Code extension storage. Fixture-backed.

KiloCode

VS Code extension storage. Fixture-backed.

OpenClaw

JSONL-like agent files. Fixture-backed.

Splunk integration

Telltale writes append-only JSONL events to a local file. Use your existing log shipper (Splunk Universal Forwarder, Filebeat, Fluentd, etc.) to forward that file to your SIEM. Each event includes rule IDs, risk scores, categories, redacted evidence excerpts, and response guidance. Splunk can index these events for alerting on high/critical detections, dashboards tracking agent activity volume, and investigations linking findings back to preserved source artifacts.

Design principles

  • Detection-first: deterministic rule matching before optional LLM triage.
  • Privacy-by-design: redacted excerpts and evidence hashes, not raw transcripts.
  • Fixture-tested: synthetic session stores for safe validation without touching real data.
  • Batch-oriented: scan on demand or watch for changes, emit structured telemetry.
  • SIEM-friendly: stable JSONL schema with response contracts for analyst workflows.
  • Extensible: add new agents, rules, and policies without disrupting existing detections.

What it is not

Telltale is not a complete prevention product and it is not the whole Agent Archaeology practice. It is one open-source telemetry and detection layer that helps teams preserve and inspect evidence.

Upstream documentation

These pages summarize concepts. For authoritative install steps, flags, schemas, and release-specific behavior, check the Telltale repository.