How the fabric works
Why detectors contribute instead of deciding, and what happens to what they contribute.
The preset plugin
One plugin that expands into the whole fabric, in the one order that makes it work.
The global preset plugin
The same fabric, decided once for a fleet of routes instead of slot by slot.
Threat policies
Turning a score into an action, without breaking production on the first day.
Bans and memory
The cluster-wide ban registry, and the ledger that decides who joins it.
Events and incidents
One normalised event shape, and the correlation that makes alerting survivable.
Fail2ban
Banning a caller that keeps failing — across the cluster, and into the shared score.
Alerting & SIEM export
One message per attack to Slack, Teams, PagerDuty or a webhook, and the decisions in OCSF.
Traffic guard
Learning each route's usual traffic, and scoring a surge away from it.