Playbook
Bot Scans And Brute Force Attacks
Use HoneyMesh traps for Behavior-Based Detection, confirm JA4-first context, then escalate to Kernel-Level Blocking with eBPF/XDP only after allowlist review.
The problem
Bots are scanning services or brute forcing exposed entry points, and you need behavior-based proof before blocking.
Operator approach
Start with the documented workflow for the tool, collect evidence, and keep the next step visible before changing settings, blocking traffic, unlocking storage, or transferring sensitive files.
First steps
- Review Live Threat Stream event rows for trap hits, repeated attempts, and source behavior
- Check IP, port, JA4/JA3, app, session, action, and active-ban status
- Use BLOCK, EXTEND, PERMANENT, RELEASE, or WHITELIST intentionally
- Move to ENFORCE only after allowlist review and share intelligence only through Pro Exchange/trusted mesh when explicitly enabled