Agentic HoneyNet SOC COCKPIT v1.0
Search IPs, Hashes, CVEs, Cowrie commands... ⌘K
SCOPE:
1 SENSOR ONLINE
SA
Security Analyst TIER-3 OPERATOR
24H ATTACK VOLUME +18.4%
584
Automated bot probes & scans
UNIQUE ATTACKER IPS ±0%
89
Geolocated in 24 Countries
SEV-1 THREAT INCIDENTS 14 CRITICAL
14
Exploits & Droppers filtered
ACTIVE BOTNET CLUSTERS KùzuDB
2
Coordinated C2 campaigns
IN-THE-WILD CVE EXPLOITS ACTIVE
6
e.g. PHP CVE-2026-109618

24h Attack Frequency Timeline (Hourly Distribution)

ClickHouse Telemetry

Targeted Decoy Vectors & Top ASNs

DECOY PORTS

  • SSH / Cowrie (Port 22)412 hits
  • Web Decoy (Port 80/443)148 hits
  • Telnet / Cowrie (Port 23)24 hits

ATTACKER ASNS

  • AS204957 (Tor Exit Node)DE
  • AS44477 (VPS Hosting RU)RU
  • AS60404 (Proxy / Scanner)NL

Global Attack Origin Radar (Real-Time Ingestion Map)

LIVE SENSING

Raw Telemetry Events Stream

LIVE INGESTION 0 / 50 Buffer
TIMESTAMP (UTC) SENSOR ATTACKER IP TARGET PORT EVENT TYPE CREDENTIALS PAYLOAD / COMMAND NOVELTY ACTION

Embedded Threat Knowledge Graph (KùzuDB Engine)

Attacker IP Malware C2 Server CVE Vulnerability Target Sensor

Client CTI Threat Intelligence Reports

Hetzner Storage Box BX11 Delivery (Dropzone)
REPORT ID CLIENT / TENANT TYPE REPORTING PERIOD LANGUAGE GENERATED AT FILE SIZE DELIVERY STATUS ACTIONS

Human-in-the-Loop (HITL) Action Approval Queue

Action-Confidence Gated Tier-3 Governance

AI Security Copilot (Caged Pi Agent)

Multilingual & Analyst-Adaptive
Qwen-72B Dual-Engine
Caged Pi Copilot just now
Hello Operator. I am continuously triaging live ClickHouse telemetry and synthesizing the KùzuDB threat graph. You can ask me questions in English or German about specific attacker IPs, campaigns, CVE matching, or mitigation playbooks.

Tenant Directory & CTI Package Feature-Gates

Clean Slate (Zero Mock Data)
TENANT ID ORGANIZATION CONTACT / ALERT EMAIL TECH-STACK TAGS CVE EARLY-WARNING FIREWALL FEED ACTIONS

sensor-01 HEALTHY

debian-4gb-s1 | Hetzner FSN1-DC14 (Assigned to: Customer_00)
Owner Tenant:Customer_00 (Internal)
Tailscale Mesh:100.85.172.100 (tag:sensor)
Public Decoy IP:95.216.215.13
Deception Profile:web_bastion
Disk Puffer:18% used (32 GB free)
Auto-Cleaner:Active (*/15 min cron)

EMBEDDED DECEPTION CONTAINERS

cowrie (SSH 2222) nginx-decoy (HTTP 80) vector-shipper (Mesh)

Routine Tasks & Automated Cronjobs Scheduler

Ghost Vault Automation Engine

Platform Log-Explorer & Audit Trail

Fulltext Search & Audit Trail

Admin Emergency Alerting & Notification Channels

Instant Sensor & Backup Pushes

Kognitives Agenten-Tagebuch (Caged Pi Shift Journal)

Daily Cognitive Reflections & Learning

Cockpit Appearance & Visual Themes

Adaptive Eye-Care Design

Choose your preferred color palette and luminance profile. Themes are applied instantly across all analyst dashboards and persisted to your local profile.

🟣 Cyberpunk Dark
Neon blue & purple glassmorphism with high dark contrast. Platform default.
🌑 Nordic Slate
Soft charcoal and muted ice-blue. Ergonomic, low eye-strain for long SOC shifts.
⬛ OLED Midnight
0% RGB true pitch black with sharp cyan accents. Ideal for OLED/HDR displays.
☀️ Clean Daylight
Bright slate & crisp white light mode with dark typography for daylight spaces.

Telemetry & Stream Preferences

Subsystem Health & Latencies

Backup Vault (Hetzner Storage Box BX11)

Storage Box: u698125.your-storagebox.de:23 (Sub-Account: u698125-sub1)

Protocol: Passwordless ED25519 SSH Sync with Zstd-19 + age encryption

Available Capacity: 984 GB / 1000 GB (98.4% Free)

Nightly Backup Job: Daily at 00:00 UTC (ClickHouse tables, PocketBase WAL, Kùzu Graph)

ESC
Start typing to search cross-platform threat intel...

🛡️ Onboard New External Tenant

Used to match high-priority in-the-wild CVE early warnings.

📄 Generate CTI Threat Report (XeLaTeX)

The report will be compiled on Ghost Vault via XeLaTeX and uploaded securely to the customer's dropzone on Hetzner Storage Box BX11.

✉️ Dispatch Report via Dropzone Link

The report remains safely stored in the Hetzner Storage Box dropzone. An encrypted, time-limited download link will be dispatched via email to the recipient.

⏹ Platform Kill Switch Override

WARNING: Activating the Kill Switch will immediately suspend all automated agent actions, drop live HoneyNet feeds into strict read-only mode, and pause vector ingestion pipelines.

Status: INACTIVE (SYSTEM OPERATIONAL)