---

title: Working with the Large Telemetry Model (LTM)¶

Working with LTM¶

LTM is a telemetry intelligence layer that consolidates multi‑source security events, normalizes them, and preserves raw context for learning.

ecOS + LTM Workflow¶

1. Sense & Normalize — SEB captures targeted signals and transmits via an external, versioned mapping. LTM normalizes to a common schema and computes stateful identifiers.
2. Reason & Correlate — LTM builds unified representations across sources/time windows and returns contextual insights, probabilistic associations, and explainable confidence.
3. Label & Learn — ecOS surfaces labels/rationales from SynA and history; human and model feedback fuse into a calibrated final label. LTM stores labels and updates models.
4. Generate & Update — Operators can provide public intel/artifacts; LTM performs generative extraction to produce structured behaviors and policies for review and activation.