CLEVERS

Ternline is an open-source threat detection and investigation engine built for distributed microservices. THE PROBLEM: Modern attacks hop across multiple microservices (e.g., API Gateway → Worker → Database), making them invisible to siloed log monitors. At the same time, putting AI directly on high-speed log ingestion is impossible due to latency (>500ms) and cost. WHAT IT DOES: Ternline solves this with a two-track architecture: 1. Fast Track (Line Rate): Evaluates incoming telemetry in <1ms using atomic Redis Lua scripts to correlate multi-hop attack chains in real time, with zero LLM overhead. 2. Deep Track (On-Demand AI): When an incident is flagged, Meta Muse Spark analyzes the cross-service trace, formulates root-cause hypotheses, and proposes new detection rules. 3. Verification & Self-Hardening: An automated auditor verifies all event citations against database ground truth to eliminate hallucinations, while a replay engine backtests proposed rules against historical traffic before hot-loading them into production.