From b0de3cd18221111167e15ddc9feb597aa7b7b8c9 Mon Sep 17 00:00:00 2001 From: anti Date: Sun, 26 Apr 2026 05:17:55 -0400 Subject: [PATCH] Service-Bus: document attacker.intel.enriched + new wake-signal consumers --- Service-Bus.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Service-Bus.md b/Service-Bus.md index fa34e2e..24782e9 100644 --- a/Service-Bus.md +++ b/Service-Bus.md @@ -148,7 +148,9 @@ Current topic families: | `topology.{id}.status` | Mutator | `{state, reason}` | | `decky.{id}.state` | _reserved_ | — | | `decky.{id}.traffic` | _reserved_ | — | -| `attacker.observed` | _reserved_ | — | +| `attacker.observed` | Correlator | first sighting; consumed by `decnet enrich` as a wake signal | +| `attacker.scored` | Profiler | post-enrichment score update; also wakes `decnet enrich` | +| `attacker.intel.enriched` | `decnet enrich` | `{attacker_ip, aggregate_verdict, providers}` after a threat-intel pass; webhook → SIEM | | `system.log` | _reserved_ | — | | `system.bus.health` | Bus worker heartbeat | `{ts, uptime_s}` |