Live defender diagnostics

System health

The public testbed shows operational status while private identities and targetable endpoints remain isolated.

Live feed reconnecting

A defensive service needs attention

Observer live; AI investigator stale; assessment state catching_up.

Public live feed
Deterministic observerlive

417 ms latest lag · backlog present

AI investigatorstale

gpt-5.6-sol · xhigh · Queued · 146 revisions pending

HTTP events
408

Last 15 minutes

Process events
6,628

Last 15 minutes

Network flows
6,308

Last 15 minutes

Detection p95
585 ms

Last 15 minutes

Collection posture

Coverage map

Endpoint-specific details are sanitized; coverage semantics remain live.

Public gateway · ports 80/443Covered

HTTP transactions, event-driven workload process lifecycles, and attributed network flows are observed.

Loopback ingress · [redacted]Partial

Request telemetry is bypassed; event-driven shell, discovery, network-client, and sensitive-file process consequences can still alert.

Response authorityNot collected

Shadow mode only. The defender cannot block traffic, terminate workloads, or send external alerts.