Run a file, then walk through the result.

Start with one of the included inputs or your own small file. The workspace then walks you through the result in separate pages for results, explanation, diagnostics, and raw files.

Run an included input or upload your ownAccepts normalized CSV, Zeek, and NetFlow/IPFIX CSVShows what was skipped and whyWalks you through the result page by page

Open demo workspace

One example scoring command

beacon-ops score --input data/operational/fixtures/netflow_demo.csv --input-format netflow-ipfix-csv --model-artifact models/operational/demo_rf --profile balanced --output-dir results/operational/demo

Featured detection

One included suspicious input

10.0.0.5 -> 203.0.113.10:443/tcp

mediumnetflow_demo.csvbalanced profile

Hybrid score

1.357

RF score

0.575

Threshold

0.00

This flow rose to the top because the same source kept contacting the same destination on a repeated schedule, and the trained model also ranked it highly.

Why this rose to the top

The timing between connections is very regular.The timing between connections is very regular.Each connection is sending almost the same amount of data.

1. Run

Open an included input or upload a small file and let the scorer process it.

2. Read

Use the Results and Explanation pages to understand what the run flagged and why.

3. Drill down

Open Diagnostics or Files only if you want the deeper detail behind the same run.

Input rows

Loaded events

Skipped rows

Alert count

What opens after a run

The workspace keeps the main answer first, then leaves the raw outputs for later.

alerts.csv

The flows the system thinks deserve review first, with short reasons.

scored_flows.csv

Every grouped flow with the rule score, model score, and final combined score.

run_summary.json

A machine-readable summary of what was loaded, what was skipped, and which settings were used.

report.md

A human-readable report that explains the run in plain language and keeps the score wording conservative.

Run a file, then walk through the result.

What opens after a run

Step into the workspace