Layer 01 · SENSE · four-layer stack
Before any reasoning happens, something real must be observed. Our honeypot sensors pose as vulnerable internet-facing services and receive genuine attack traffic. Nothing here is synthetic: every number below is a live query into production telemetry.
Vulnerable-looking services exposed on purpose. Attackers find them the same way they find anything: scanning.
Each probe is logged as an event — source, timing, protocol, payload shape. Individually noise; in aggregate, a live map of adversarial behaviour.
IPs, credential patterns, fingerprints — indicators of compromise ready for correlation in layer 02.
Arrivals follow $P(k) = (\lambda t)^k e^{-\lambda t}/k!$ per window. λ is estimated live from the last hour; the homepage overlays observed counts on this model. Deviation from the model is itself signal.