HYVE NARRATOR · AUDIENCE-AWARE RENDER

NARRATOR

5 AUDIENCES · DETERMINISTIC RENDER · SOC TO EXECUTIVE

One structured event in. Five differently-toned reports out — each written for a specific audience. SOC analysts get indicator-rich telemetry. Executives get the bottom line. Legal gets the statutorily-relevant detail. Helpdesk gets reassurance. MSSP gets the multi-tenant ticket-grade summary.

Narrator is template-rendered, not LLM-prompted — same input always produces the same output. Auditors love it. Counsel signs off on it. SOCs trust it. Use it standalone or via Omega in HYVE Ether OS.

One event. Five audiences. Five tones.

Same source event below — an outbound DNS block at 18:09:42 UTC — rendered for each audience.

• SOC

  Security Operations Center analyst

  Indicator: Outbound DNS query to known-bad domain at 18:09:42 UTC, source PID 14322, blocked. No exfiltration suspected.

• Executive

  C-suite, board, exec briefing

  An attempted data exfiltration was blocked this evening. No customer data was exposed. Standard incident response is in progress; full report by Thursday.

• Legal

  Counsel, compliance, regulatory

  On 2026-05-08 at 18:09:42 UTC, outbound network traffic to a domain on our blocklist was attempted and blocked. No personal data was transmitted. Incident does not trigger statutory breach notification under GDPR Art. 33 or applicable U.S. state law.

• Helpdesk

  Tier-1 support, end-user-facing

  Your machine blocked an outgoing connection that looked suspicious. You don't need to do anything — everything is fine. If you keep seeing this, please contact IT.

• MSSP

  Managed security service provider, multi-tenant

  Tenant ACME-CORP · BLOCKED outbound to flagged.example.com at 18:09:42 UTC · src=workstation-22 · pid=14322 · TIRA score 8.2/10 · automated containment applied · SLA acknowledged.

// Cargo.toml: hyve-narrator = "1.0"
use hyve_narrator::{NarratorClient, Audience, Event};
use serde_json::json;

fn main() -> anyhow::Result<()> {
    let narr = NarratorClient::local();
    let event: Event = serde_json::from_value(json!({
        "type": "outbound_blocked",
        "domain": "flagged.example.com",
        "ts": "2026-05-08T18:09:42Z",
        "pid": 14322,
    }))?;

    for audience in [Audience::Soc, Audience::Executive, Audience::Legal,
                     Audience::Helpdesk, Audience::Mssp] {
        let rendered = narr.render(&event, audience)?;
        println!("--- {audience:?} ---\n{}\n", rendered.text);
    }
    Ok(())
}