MetaTriage

A meta-methodology system for triaging telemetry sessions. The system focuses on "boxing-in" anomalous signal behaviour in an unsupervised manner using a combination of graph-based and statistical representations of telemetry. The goal is to expose behavioural patterns that are not easily captured by a single representation or scoring method, and to provide information sufficient for interpretable and intentional method implementation.

Telemetry Events -> Review Unit Selection & Freeze -> Representation Embeddings -> Anomaly Scoring Methods -> Ranked Anomalous Queue -> Dossier of boxed-in anomalous signal behaviour

Install

python -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt

Run

streamlit run main.py

Point it at a CSV, Parquet, or JSON file, map your columns in the sidebar, pick the methods to compare, and run.

Two ways to configure a run. An agent config, the JSON an LLM produces after inspecting the dataset, or manual column pickers.

Sidebar: Dataset source (upload, bundled, or local path), a slice slider that reads the real row count before loading anything, column mapping with name-based guesses, feature selection, methods, and an Advanced section for k, session windows, training epochs, review budgets, and device. Any run can also be configured by pasting JSON, and every run prints its own JSON back so you can reproduce it.

Four Result Tabs

Tab	Purpose
Results	Headline metrics with lift over random, ranked shortlist, comparison bar chart, full method matrix, and an explicit failures-and-abstentions panel
Session Map	Every session embedded as a point, UMAP or PCA, interactive (pan/zoom/hover) or static html embedded DataMapPlots, coloured by anomaly score or by label
Signal Tracing	How the anomaly signal is organized over the session graph, and what the matched transform does to the queue
Ranked Sessions	The review queue, with how many positives landed inside the budget, and a CSV download
Research Details	Config, run manifests, scorer diagnostics, training-loss curves, per-seed metrics, dataset preview, and three downloads

Or drive it from Python:

from metatriage import Config, run

config = Config.from_file("config.example.json")
result = run(dataframe, config)

print(result.table())        # every method, best first
print(result.best().name)    # highest average precision

Notes

• Project still in progress and is currently in experimental research phase

• Next phase is to revise the method x metric format to focus on interpretability chasing via more intentional "boxing in" of anomalous signal behaviour

• Feature columns may not reuse a schema role or the label column. The config rejects that outright since it's the easiest way to accidentally fake a good score.

• Learned representations run once per seed and their metrics are averaged with the spread reported. A method that wins on one seed and collapses on the next has not won.

• A method that fails is recorded with its error and the run continues. A failure is a result.