anti/DECNET
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Service-Bus: document attacker.intel.enriched + new wake-signal consumers

anti
2026-04-26 05:17:55 -04:00
parent a574fde3a2
commit b0de3cd182
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Service-Bus.md

@@ -148,7 +148,9 @@ Current topic families:
| `topology.{id}.status` | Mutator | `{state, reason}` | | `topology.{id}.status` | Mutator | `{state, reason}` |
| `decky.{id}.state` | _reserved_ | — | | `decky.{id}.state` | _reserved_ | — |
| `decky.{id}.traffic` | _reserved_ | — | | `decky.{id}.traffic` | _reserved_ | — |
| `attacker.observed` | _reserved_ | — | | `attacker.observed` | Correlator | first sighting; consumed by `decnet enrich` as a wake signal |
| `attacker.scored` | Profiler | post-enrichment score update; also wakes `decnet enrich` |
| `attacker.intel.enriched` | `decnet enrich` | `{attacker_ip, aggregate_verdict, providers}` after a threat-intel pass; webhook → SIEM |
| `system.log` | _reserved_ | — | | `system.log` | _reserved_ | — |
| `system.bus.health` | Bus worker heartbeat | `{ts, uptime_s}` | | `system.bus.health` | Bus worker heartbeat | `{ts, uptime_s}` |