Skip to content
Agent Archaeology

Telltale

Schemas

Telltale reads supported session stores, evaluates detection rules, and writes redacted JSONL. The event schema describes that telemetry file.

SIEM event schema

The event schema defines the structure of telemetry written to the default JSONL sink (an OS-standard per-user path under the user path profile, or an explicit --log-path). Each event follows schemas/event.schema.json.

Artifact Paths

Required fields

schema_version, event_id, telltale_version, timestamp, observed_at, ingested_at, time_source, time_confidence, severity, risk_score, risk_contributions, client, session_id, tags, evidence

Common required Event3 fields; each event family adds its own required fields, including event_type.

Event types

activity, detection, session_risk_summary, health, scanner_error, operational_alert, process_chain, correlation

Enum of supported event_type values.

Severity levels

informational, low, medium, high, critical, warning

Common severity values; standard activity/detection families exclude warning.

Evidence structure

Detection events include an evidence array with redacted values and optional hashes:

  • field: the source field name that matched
  • redacted_value: the redacted excerpt (required)
  • hash: optional cryptographic fingerprint for correlation
  • rule_id: optional reference to the matching rule

Timeline anchors and risk contributions

There is no triage event family or triage object in Event 3.0. Native risk is a positive deterministic contribution ledger. Unsuppressed detections may include top-level timeline_anchors:

  • risk_contributions: id, type, positive points, and bounded rationale; risk_score is the checked exact sum.
  • timeline_anchors: entry_index, rule_ids, categories, and evidence_fields.
  • Suppressed detections have zero risk, empty contributions, and no response or timeline anchors.

Response contract

Unsuppressed detection and process_chain events require deterministic response guidance. Suppressed detections omit it. This object does not execute an action:

  • recommended_action: one of monitor, review, investigate, investigate_immediately
  • response_playbook: stable Telltale playbook identifier
  • investigation_summary: short redaction-safe summary
  • escalation: routine_review or security_review_required

Source evidence model

Telltale reads the session store, evaluates detection rules, and writes the JSONL described above. Keep the original store if you need fields the telemetry does not include.

Design principles

Normalize enough to compare events across tools, but keep links or hashes that allow an authorized reviewer to return to the source artifact. Do not make raw full transcripts the default SIEM payload. Use redacted excerpts and controlled access to originals.