M2 (#168). Attacker IPs captured by the honeypot auto-feed the mitigation plane: a source that scans your fake ports gets rate-limited/RTBH'd before it finds a real service.
Status: NONE (planes are separate processes) · Size: M/L · Home: blackwall (new event path).
Pro: the point of running both planes on one box. Con: new event path; route the trigger through shadow (#9) + caps (#10). Needs its own spec→plan.
M2 (#168). Attacker IPs captured by the honeypot auto-feed the mitigation plane: a source that scans your fake ports gets rate-limited/RTBH'd before it finds a real service.
Status: NONE (planes are separate processes) · Size: M/L · Home: blackwall (new event path).
Pro: the point of running both planes on one box. Con: new event path; route the trigger through shadow (#9) + caps (#10). Needs its own spec→plan.