[deploy] #12 Deception → mitigation intel loop #180

New issue

Open

opened 2026-07-11 13:45:56 +00:00 by vxfemboy · 0 comments

vxfemboy commented

2026-07-11 13:45:56 +00:00

(Migrated from github.com)

M2 (#168). Attacker IPs captured by the honeypot auto-feed the mitigation plane: a source that scans your fake ports gets rate-limited/RTBH'd before it finds a real service.
Status: NONE (planes are separate processes) · Size: M/L · Home: blackwall (new event path).
Pro: the point of running both planes on one box. Con: new event path; route the trigger through shadow (#9) + caps (#10). Needs its own spec→plan.

**M2** ([#168](../168)). Attacker IPs captured by the honeypot auto-feed the mitigation plane: a source that scans your fake ports gets rate-limited/RTBH'd before it finds a real service. **Status:** NONE (planes are separate processes) · **Size:** M/L · **Home:** blackwall (new event path). **Pro:** the point of running both planes on one box. **Con:** new event path; route the trigger through shadow (#9) + caps (#10). Needs its own spec→plan.