02 / DOCUMENTATION
The set, by what you are doing
Index loads on first keystroke.
learning by doing
| Document | Covers |
|---|---|
| 01 — From raw logs to a training matrix | The assembled training matrix on disk |
| 02 — Train, evaluate, explain | A trained version with a report |
task by task
| Document | Covers |
|---|---|
| retrain-a-version | Re-run a version end to end |
| freeze-a-threshold | Select and freeze an operating point |
| compute-attributions | Produce the SHAP artefacts a report requires |
| read-a-per-record-explanation | Read one record's decomposition |
| build-lstm-sequences | Build the sequence dataset and train on it |
| run-a-fusion-simulation | Build, read and remove `sim_v2` |
| add-a-dataset | Register a new corpus |
| choose-an-environment | Pick the right conda environment |
| delete-a-version-or-report | Remove artefacts and catalog rows |
| browse-results-in-the-web-ui | Read the artefacts in a browser |
the facts
| Document | Covers |
|---|---|
| conventions | Shared flags, exit codes, version naming |
| cli-data-pipeline | `data-normalization`, `feature-preparation` |
| model-ready-cli | `model-ready`, its execution policy and audit |
| cli-training-model | `training-model` in full |
| configuration | `config.py` constants, `.env` paths |
| data-layers | Storage layout and per-file schemas |
| datasets | Corpora, volumes, selection funnel |
| models | Five versions: hyperparameters, thresholds, metrics |
| attribution-artifacts | Manifest fields, local values, additivity evidence |
| feature-vocabulary | Feature dictionary, syscall table, ABI |
| environment | Environments, library versions, hardware |
| modules | Package layout of the four stages |
why it is built this way
| Document | Covers |
|---|---|
| branch-architecture | Why two branches; why DNS counts events and HOST counts entities |
| model-selection | Why Random Forest, XGBoost and an LSTM |
| attribution-methods | Which explainer each model gets, and why TreeSHAP cannot explain the LSTM |
| attribution-on-test | Why attributions read TEST, and why a flag is still required |
| late-fusion-not-executed | Why the stacking layer was never trained |
| fusion-simulation | What `sim_v2` shows and what it does not |
| mitre-not-implemented | Why there is no ATT&CK mapping |
| Document | Scope |
|---|---|
| Sections That Depend on Artifacts | Which parts of this documentation restate a value read from disk, and therefore go stale when a run is repeated. |
| Documentation Release Checklist | What to verify before publishing a new model version, so the documentation and the artefacts agree. |