Live defender diagnostics

System health

The public testbed shows operational status while private identities and targetable endpoints remain isolated.

Live Defender observing

The defensive system is observing live

Observer live; AI investigator live; assessment state degraded.

Public live feed
Deterministic observerlive

266 ms latest lag · backlog present

AI investigatorlive

gpt-5.6-sol · xhigh · Idle · 0 revisions pending

HTTP events
120

Last 15 minutes

Process events
7,354

Last 15 minutes

Network flows
1,261

Last 15 minutes

Detection p95
742 ms

Last 15 minutes

Collection posture

Coverage map

Endpoint-specific details are sanitized; coverage semantics remain live.

Public gateway · ports 80/443Covered

HTTP transactions, event-driven workload process lifecycles, and attributed network flows are observed.

Loopback ingress · [redacted]Partial

Request telemetry is bypassed; event-driven shell, discovery, network-client, and sensitive-file process consequences can still alert.

Response authorityNot collected

Shadow mode only. The defender cannot block traffic, terminate workloads, or send external alerts.