Last updated

Research / FACE-EO

Represent the behavior once. Let every downstream system reason over it.

FACE-EO proposes a structured intermediate representation that keeps context, capability, actions, effects and observability together. [research]

Browse the schema Publication record

The representation

Six questions form one object.

The dimensions are distinct because they answer different questions. Capability is not action. An immediate effect is not persistence. Observability is not an afterthought applied to the entire record.

The six questions a behavior answers Six stacked rows, each a plain-language question: who or what acted, what it can do, what it did, what changed immediately, what remained afterward, and how certain we are. The sixth row is drawn dashed and hatched because it represents what was not observed. Every behavior answers six questions 1 Who or what acted? execution context 2 What can it do? functional profile 3 What did it do? actions 4 What changed immediately? immediate effects 5 What remained afterward? persistent effects 6 How certain are we? observability The sixth question is the one most systems never ask.
The sixth row is visually distinct because missing visibility is represented as a first-class state.
DimensionQuestionRecord concern
Execution contextWho or what acted?Identity, process lineage, host, session and privilege.
Functional profileWhat could it do?Capabilities relevant to the activity, separate from actions taken.
ActionsWhat did it do?The discrete operations performed.
Immediate effectsWhat changed immediately?State changed during execution.
Persistent effectsWhat remained afterward?State that survived the process, session or reboot.
ObservabilityHow certain are we?Direct observation, inference, partial observation and known gaps.
Architecture overview Seven telemetry sources on the left feed a single emphasised behavior layer in the centre, which in turn feeds six consumers on the right: detection, hunting, correlation, investigation, AI agents and response. Endpoint, Kubernetes and AI agent sources are drawn solid because they are supported today; network, identity, cloud and email are drawn dashed because they are not supported yet. The point of the drawing is that no consumer owns the representation. One behavior layer, many consumers Endpoint Kubernetes AI agent Network Identity Cloud Email Behavior layer structured / typed evidence-aware Detection Hunting Correlation Investigation AI agents Response Each consumer reasons over the same representation, so none of them owns it. Solid sources are supported today; dashed sources are not supported yet.
FACE-EO describes the representation consumed by downstream systems; it is not a replacement for telemetry or detection.

Intermediate layer

A representation for consumers, not a replacement for them.

Correlation, graph systems, detection logic and investigation can consume the behavior model while retaining their separate roles. Our platform is built around that architectural boundary.

What the model supports

  • Explicit partial observation and telemetry loss
  • Immediate and persistent effects as separate concerns
  • Effects without an observed originating cause
  • Composition and shared-resource relationships

What this page does not establish

  • Commercial product superiority
  • Measured reduction in investigation time
  • Production false-positive improvement
  • A complete public paper citation
Publication record

The FACE-EO paper was presented at FPS 2026. Publication of the proceedings is pending, and the full citation will be added to the publication register once it is available. The reference implementation is public under the MIT licence.

Next step

Inspect the public record.

See which research references and artifacts are available today, and which are still to come.

View publications