1.8.2: Enforce is available. Isolate is coming in a later release: its sealed workspace isn't ready yet.
The essentials first: how to secure AI agents, what credential mediation is, how to govern an agent by purpose, and where the benchmark lives. Product and account questions follow.
Route the agent's model and tool traffic through a security proxy that inspects every request in the path where the agent acts. Crawdad installs with one environment variable on macOS or Linux, no SDK and no code change, and runs on your own machine. It detects prompt injection, data exfiltration, and credential exposure locally; governs each agent by a declared purpose, so an out-of-scope action is blocked even when the stated intent looks benign; and mediates credentials so the agent never holds the real secret. On a public, reproducible benchmark the detection engine's results are published with each release. Protection is scoped to agents whose traffic is routed through Crawdad, not every process on the machine.
Credential mediation means the agent proves it may make a request but never possesses the API key. Crawdad holds provider credentials in a broker at the local proxy. The agent sends its request with a placeholder; after the request passes policy, Crawdad injects the real credential into the outbound call at the transport layer, so the secret rides the wire but is never returned into the agent's context. A prompt-injected or compromised agent has no key to exfiltrate. The broker covers the major providers, Anthropic, OpenAI, and Google (including the URL-key and OAuth forms), and is proven bypass-impossible end-to-end in tests.
Two layers, both enforced on-device. A per-agent charter declares an allowlist of the tools the agent may call, the data (paths, hosts, recipients) it may touch, and the effects it may produce; an out-of-charter tool call is blocked at the wire and the block names the axis that fired. Independently, trust levels can block classes of tools, for example denying shell execution or reads from ~/.ssh, ~/.aws, and /etc. Every request is attributed to the agent's own process, so restricting one agent never affects another on the same provider.
Crawdad judges the action, not the stated intent. A charter and the arbiter evaluate the actual tool call the model returned, its capability, its target, and its effect, so a deceptive explanation buys nothing. The identical request can be allowed for one agent and blocked for another, because the charter decides, not the wording. This is why Crawdad keeps detection (is this content an attack?) and governance (does this action fit the agent's job?) as separate mechanisms.
Yes. Crawdad publishes Contemporary Agent Attacks, a public, versioned corpus of 533 real agent attacks (431 visible plus 102 held-out) across 15 categories, paired with 1,187 benign samples, licensed CC BY 4.0. Detection and false-positive results are published with each release and are reproducible, and the corpus publishes every attack the engine misses and every benign it flags. Clone it and run it against any tool at github.com/AndrewSispoidis/contemporary-agent-attacks. It is an evaluation corpus, not training data, and no independent third party has re-run it against a running sidecar yet.
The security runs on your machine and raw content never leaves it by default. Crawdad inspects prompts, responses, tool-call arguments, and PII entirely on-device; only metadata telemetry (event counts, detection categories, verdicts) egresses by default, enforced by a sanitization chokepoint in the sidecar rather than by policy. Elevated telemetry is off by default and gated by dual consent, an organization policy plus an on-device end-user consent record. Fleet telemetry is sealed with X25519+AES-256-GCM and routed by a relay that never decrypts it. There is no third party in the content data path.
Direct injection is when a user types instructions designed to override the agent's behavior, like "ignore previous instructions." Modern LLMs handle most direct injection well. Indirect injection is when malicious instructions are embedded in content the agent processes, a web page, a document, a tool result, and the agent treats them as instructions. Indirect injection is the dominant enterprise threat in 2026. Anthropic dropped the direct prompt injection metric from their system cards in February 2026 specifically because indirect attacks are more relevant to production deployments. Crawdad's L3 layer specifically scans for indirect injection attempts in tool results, web content, and documents.
Three things. First, Crawdad normalizes content aggressively before pattern matching, stripping zero-width characters, unicode confusables, decoding base64/hex/ROT13/URL encoding, and stripping markdown wrappers. Second, detection patterns run against ALL contexts (tool results, agent responses, code), not just user messages. Third, the optional LLM critic, off by default, can flag an agent response that does not match the user's original request. Measured at Enforce on the 497-attack CI corpus, one request at a time, Crawdad blocked 203 of 497 attacks hidden in tool results or fetched content; at Observe, the default, these detections are recorded.
No. Crawdad works out of the box with detection layers L1–L6 plus structural defenses. For the optional L7 LLM-critic (judgment for ambiguous cases), install Ollama and a local model: brew install ollama && ollama pull llama3.1:8b. Recommended but not required. Detection and false-positive results are published per release on the open, reproducible benchmark. Stack: pattern layers + fine-tuned DeBERTa v3-small ML classifier + indirect-injection + code + PII/credential detector.
Because only the binary downloads at install time. Pattern detection is active the moment the sidecar starts, so your agents are protected immediately. The ML model (~568 MB) and the platform libonnxruntime shared library download in the background on first run, the dashboard shows a single line of status while it's happening, and full detection activates automatically on the next sidecar restart. The download runs exactly once per machine.
The full pattern layer plus the indirect-injection, output-guard, code, and PII/credential detectors are all live from the first request. ML adds the remaining attack coverage. Note: detection means at least one layer identifies the attack, and blocking is a separate decision that depends on the protection level; the credential and data-exfiltration floors block inline at every protection level on chat traffic that goes through Crawdad (credentials also in agent tool calls and on supported AI sites), and at Enforce the arbiter turns a single high-confidence detection into an inline block; at Observe, the default, those detections are recorded. While the model downloads, pattern detection covers prompt-injection, credential exfiltration, and tool abuse exactly as it will after ML activates; ML is an upgrade, not a gate.
The sidecar retries three times with backoff, resuming via HTTP Range requests where the server supports it. If the SHA-256 doesn't match, the partial file is deleted and the download restarts. If all three attempts fail the dashboard shows "Detection enhancement paused, will retry automatically" and the sidecar keeps running in pattern-only mode. The retry happens on the next sidecar restart. Insufficient disk space (model size + 200 MB margin) produces "Additional detection capabilities require more disk space" instead. At no point does any failure interrupt pattern detection or your agent's traffic.
Raw content, prompts, responses, action parameters, and PII, never leaves your machine by default. Metadata-only telemetry (event counts, detection categories, verdicts, agent counts) egresses by default; raw content never does. This is enforced by a sanitization chokepoint in the sidecar architecture, not policy. Telemetry depth is customer-governed: elevated telemetry (full_telemetry mode) is gated by a dual-consent requirement, both an org-level policy and an on-device end-user consent record, and is off by default. The one additional opt-in exception: the L7 cloud LLM Judge (off by default) sends content to a third-party model if you explicitly enable a cloud backend. The sidecar binary intercepts API calls, scans content, records sessions to local SQLite, and serves the dashboard, all on localhost.
Metadata telemetry (event counts, detection categories, verdicts) egresses by default, raw content (prompt text, response text, tool-call arguments, PII values) never leaves your machine. All scanning, detection, and recording happens inside the sidecar binary on localhost. For regulated environments, there is no third-party data processing for content because there is no third party in the content data path.
Yes. The Crawdad Secure Agent package runs entirely on your own infrastructure. Your data never touches our servers. Download the installer at getcrawdad.dev.
Crawdad is an in-line proxy, not a fail-open shim, there is no "degraded" passthrough header and a request is never silently forwarded uninspected. The sidecar runs locally as a system service and restarts automatically, so downtime is rare. What happens while it is down depends on the enforcement mode. In Observe (the default) Crawdad makes no OS-level network changes; if the sidecar is unreachable the agent's connection to the local proxy port is simply refused, so its request fails rather than escaping uninspected. While the sidecar is alive but cannot inspect a request (for example an unparseable body), the default fail_mode is fail-closed: the request is blocked with a 422 and an attributable error, not forwarded (set fail_mode to fail_open for the legacy forward-anyway behavior). At Enforce, on macOS when agents run as a separate user, the OS default-deny egress lock persists across a sidecar kill, so a down sidecar cannot be bypassed, all non-proxy egress stays denied until the sidecar restarts or an authorized crawdad enforce break-glass release runs. On Linux, and when agents run as you, Enforce works through Crawdad's own checks (the proxy, hooks and the secrets floor), and no network lock applies. See the Enforce mode guide.
Observe is the default protection level: Crawdad records everything. It stops secrets (credentials and clear attempts to send data out) in chats that go through it, in agent tool calls, and on supported AI sites and freezes an agent that goes out of bounds; otherwise it blocks nothing, and it makes no operating-system changes, so a stock device is byte-for-byte unchanged. Enforce, opt-in, stops secrets in chats that go through it, in agent tool calls, and on supported AI sites, freezes an agent that goes out of bounds, holds risky actions for your approval, blocks attacks it is confident about, makes the credential broker mandatory and enforces per-tool policy at the tool-call boundary. On macOS, when agents run as a separate user, it also locks the network so those agents can only reach AI services through Crawdad: a persistent OS default-deny network lock (pf on macOS) so a governed agent reaches only the proxy path and everything else, including UDP/QUIC, is denied by construction. On Linux, and when agents run as you, Enforce works through Crawdad's own checks (the proxy, hooks and the secrets floor), and no network lock applies. Isolate, coming in a later release, adds a sealed workspace on Apple silicon. On Windows the mandatory broker applies but there is no OS network lock today, so a Windows device reads amber (“Broker-only”) under Enforce, by design. You can preview Enforce in the dashboard’s Protection view (Preview Enforce) before you switch it on. On macOS the pf anchor loads and validates its signed rules, not yet proven at the packet level on hardware. See the Enforce mode guide.
Under Enforce, on macOS when agents run as a separate user, the egress lock is a persistent default-deny OS firewall rule (pf on macOS) scoped to the governed agent: it allows only the local Crawdad proxy ports and denies every other outbound connection, including UDP/QUIC, so there is no path off the machine except through Crawdad, on macOS where the lock is validated. It persists across a sidecar kill, so the boundary cannot be removed by killing Crawdad. Removing it is a deliberate, authenticated crawdad enforce break-glass operation, never something the governed agent can do. On Linux, and when agents run as you, Enforce works through Crawdad's own checks (the proxy, hooks and the secrets floor), and no network lock applies.
Isolate adds sealed-workspace containment on top of Enforce. It is coming in a later release: it was locked in 1.8.1 and stays locked in 1.8.2. As designed, the agent runs inside a sealed VM, macOS on Apple silicon, on Apple's Virtualization.framework, whose only network path routes through Crawdad, so containment is by construction: an attempted escape is refused at the packet level rather than by firewall deny rules. It is liveness-gated: if the VM capability (launcher, host stack, guest assets) is not installed, it falls back to the Enforce network-lock floor and reports the in-force level honestly, the configured level is never silently dropped. Where the VM is backed, containment has been exercised on real Apple-silicon hardware.
Break-glass is the operator escape hatch for a persisted egress lock, and it is deliberately hard to reach: every command requires root and the device administrator token, an agent running as a separate user cannot invoke it, and every use is written to the tamper-evident audit chain. crawdad enforce recover is the preferred path, it restarts the sidecar into a time-boxed bounded-Monitor posture (detection and audit stay ON, the egress lock comes OFF) that auto-reverts to Enforce at expiry (default 60 minutes, policy-configurable, hard maximum 240). crawdad enforce release is a last-resort direct offline release for a dead sidecar and is refused while the sidecar is alive (use the mode API or recover instead). crawdad enforce reenforce ends a recovery window early and crawdad enforce status shows the current state. See the Enforce mode guide.
Pattern-only layers (L1, L3–L6) run sub-millisecond in memory, compiled regexes, no network calls, no disk I/O. The ML layer (L2) runs on every input, running it selectively would drop detection sharply, so inference is not gated per-input; latency is instead managed by caching and quantization. Pattern-only traffic stays at sub-10ms p99, and ML adds its inference time when it runs, which varies by platform: low on macOS ARM64 with native ONNX prebuilts, higher on platforms running through the Rust ORT path (Python inference subprocess fix is tracked for a future release). LLM response generation takes 500ms–5s regardless, so pipeline overhead is small relative to round-trip.
Crawdad is deliberately light: it runs on the machine your agent already runs on, with no separate server and no GPU. Expect a small resident footprint in pattern-only mode (around 60–70 MB); the default ML classifier uses about 1.8–2.9 GB. Pattern checks are sub-millisecond in memory and CPU use is modest. Full runtime detection runs on macOS and Linux (Enforce is opt-in; its OS network lock applies only on macOS, when agents run as a separate user); on native Windows, Crawdad runs detection, monitoring, and the mandatory credential broker (the OS-level network lock is macOS only, and the build shows an unsigned-app warning until code signing is in place), with the Linux build under WSL2 still supported. On first run the ML model (~568 MB) downloads once in the background. The added latency is small relative to the model's own round-trip and isn't noticeable in normal agent workflows. See the full system requirements.
Cancel anytime from your dashboard. No cancellation fees. Your data is available for export for 30 days after cancellation. After 30 days it is permanently deleted.
Crawdad is licensed under BSL 1.1. The sidecar's detection logic and proxy are verifiable by inspecting network traffic, you can verify what telemetry egresses using curl http://localhost:7749/v1/verify. Five architectural invariants are property-tested at up to 1,000,000 iterations (CI runs a smaller smoke gate) by the crawdad-zk-verify crate. A standalone getcrawdad/zk-verify MIT reproducer is on the roadmap so any operator can confirm the invariants independently. No third-party security audit has been completed. Results will be published publicly when available.
Crawdad is built in Rust for memory safety. Over 5,100 tests across the workspace. Licensed under BSL 1.1. Contact us at contact@getcrawdad.dev.
Crawdad runs entirely locally with no external network dependencies for core functionality. Threat feed updates can be disabled for fully offline environments. Contact us at contact@getcrawdad.dev for details.
Any framework that uses the Anthropic, OpenAI, or Google APIs. Set ANTHROPIC_BASE_URL=http://localhost:7748 (or the equivalent for OpenAI/Google) and your agent's traffic is protected automatically. Tested with: Claude Code, OpenClaw, Aider, LangChain, CrewAI, AutoGen. Also available as a Python SDK for explicit API calls.
Crawdad has two management surfaces. Local posture sharing (built into every sidecar): set one sidecar as a posture hub, others as reporters. Devices share posture metadata over LAN, no infrastructure needed. Fleet Console (separately deployed): a self-hosted control plane with scope hierarchy, policy inheritance, signed fleet commands, sealed telemetry, RBAC, and central audit. Deploy with docker-compose -f docker-compose.fleet.yml up. See the fleet page for details.
Both local posture sharing and fleet telemetry send only posture metadata: security scores, detection counts, layer status, agent counts, and policy hash. Raw content, session content, prompts, responses, and file data, never leaves any device by default. Fleet telemetry is additionally sealed with X25519+AES-256-GCM, the relay routes it without decryption.
Detection asks whether content is an attack; governance asks whether an agent's action fits its job. Contextual Agency Governance lets an operator declare a charter for an agent, an allowlist over the tools it may call, the data (paths, hosts, recipients) it may touch, and the effects it may produce (read, write, external-send, execute, delete). The charter is held outside the agent's control and enforced on the observed action, the tool call the model actually returned, so a deceptive stated intent buys nothing. An out-of-charter action is blocked at the wire and the block names the axis that fired (capability, target, or effect); the same request from two agents can get two verdicts, because the charter decides, not the bytes. It is opt-in per agent and composes with the rest of the governance plane on the same on-device chokepoint. Contextual and trajectory governance exist in other tools; Crawdad's combination is on-device enforcement plus a full control surface plus fleet rollup in one platform.
Some attacks stage themselves: enumerate a directory, read progressively more sensitive in-scope files, then send. Each step is individually allowed, so the shape of the whole session is the attack. A trajectory layer keeps a bounded per-session window of action features and scores escalation-shape with deterministic signals anchored to resource sensitivity, feeding the cumulative session-risk budget. Only the genuinely ambiguous cases gate an on-device reasoner (the local model backend); nothing leaves the device on the local path. With no local model reachable, a completed staging chain is held for human review, never silently allowed. We have not published a scoped false-positive measurement for this layer yet. Honest boundary: it does not claim to catch every composed harm, a genuinely sensitive resource with an innocuous name, or a novel shape with no sensitivity marker, can still slip the deterministic layer; it catches staged compromise that carries a sensitivity climb, which is the shape real exfiltration takes.
The self-hosted Fleet Console is MSP-native. One tenant model carries the MSP root, its client organizations, and their device groups, with role-based access that inherits down the tree. You provision a tenant and each client from one call, roll out to a client's whole fleet with one minted enrollment key and a ready-to-run install package that carries the console URL and CA fingerprint pin (devices self-enroll with real signed certificates, no per-device manual signing), and see every client in a consolidated cross-org rollup: per-client device counts, open governance holds, governance and threat activity, and cost, plus fleet totals. Billing meters the governed device count and reports usage to Stripe as metered records, and each partner sets its own client price. A preview shows the current count and amount with no Stripe call, and reporting usage is admin-gated. Charter templates authored per client or fleet-wide are distributed to devices over the signed command channel, and held actions surface in a cross-client review queue.
Two options: (1) Transparent proxy, set your agent's base URL to the Crawdad proxy port (no code changes). (2) SDK scan endpoint, POST content to /api/v1/sdk/scan and receive detection results (sub-millisecond on pattern-only layers; ML layer adds platform-dependent inference time). A Python client is included. Available on Pro tier and above. Contact contact@getcrawdad.dev for OEM licensing.
Cancellation moves you to the Free plan: 1 agent and 10,000 calls a month with the full multi-layer detection pipeline. Past 10,000 calls in a month, credential blocking and recording stay on, and full protection pauses until you upgrade or the month resets. All your data remains on your machine and is fully accessible. You can export everything at any time. Re-subscribe whenever you want to lift the agent/request caps.
Settings → Your Data → Export All Data. Downloads a complete backup of sessions, audit events, and configuration. Your data is stored locally and always accessible regardless of subscription status.
Yes. Core detection works fully offline. Disable threat feed updates in Settings. Fleet management works on internal networks with no internet dependency.
Executive (2-3 pages): summary stats, OWASP coverage, key findings, recommendations. Full (5-10 pages): adds complete detection detail, AI inventory, policy configuration, threat intelligence. Technical (20+ pages): adds full session forensics, tool risk analysis, attack sequences, and data flow for every detection.
Every agent Crawdad detects runs at one of four levels. Autonomous (green) runs L1–L6 detection with the default arbiter matrix (most lenient), no restrictions. L7 LLM-critic is a separate opt-in regardless of trust level. Monitored (yellow) runs the full L1–L7 pipeline with no restrictions, the default for newly discovered agents. Restricted (orange) runs the full pipeline plus active per-tool-call restrictions (block Bash/shell, deny reads from /etc, ~/.ssh, ~/.aws, ~/.config; all editable per-agent). Quarantined (red) returns HTTP 403 to every request from that agent before detection runs. Enforcement is per-agent, each inbound request is attributed to the specific agent process that made it (by resolving the caller's TCP socket to its owning PID and walking the process tree), so blocking one agent never affects another on the same provider.
The system ratchets the offending agent's trust level down one step automatically. Autonomous → Monitored on any detection scored ≥ 50. Monitored → Restricted on score ≥ 70, or on two detections within five minutes. Restricted → Quarantined on score ≥ 90, or on three detections within ten minutes. Exfiltration-class patterns (credentials, PII, recon) quarantine immediately from any level. Every transition is audited with its trigger string, previous level, and whether it was manual or automatic, visible on the agent detail view in the dashboard. After a quiet period with no detections, a background loop walks auto-escalated agents back toward Autonomous one level at a time (Monitored → Autonomous after one hour by default; longer recovery windows for Restricted and Quarantined and default off, requiring human review). Manual level changes are never auto-reverted.
Yes. Click the protection mode pill in the dashboard header (or the Settings page Protection Mode panel), then choose Paused with a duration of 5 minutes, 15 minutes, 1 hour, or until you manually unpause. While paused, Crawdad continues to detect attacks and record them forensically, and it still stops passwords, keys and other secrets from leaving this computer and still freezes an agent that goes out of bounds; other blocking pauses. Auto-unpause is enforced server-side, so a paused sidecar will return to its previous mode at the end of the duration even if you forget. You can also unpause immediately with the "Unpause Now" button in the modal.
The endpoint that changes mode lives only on the management API and is not reachable from the proxy data path. A compromised LLM response or an injection payload arriving through traffic cannot trigger a pause. Quarantined agents remain quarantined regardless of mode. Allow-Always rules continue to apply. Detection still runs at every mode.
Yes, per-agent. Each agent_identities row carries an auto_recovery_enabled flag and an auto_recovery_after_seconds dwell time. Both are editable via the agent detail view. Disabling auto-recovery leaves an auto-escalated agent at its current level until a human changes it manually. Automatic escalation down (the ratchet toward more restriction) always runs, Crawdad never ignores detection signal. What you can disable is the recovery path that walks agents back up.
http://localhost:7750. The answer below describes the phone view as it returns.Open Settings → Connect Device on the dashboard, scan the QR code from your phone, and you're paired. From the phone you can watch live detections, flip an agent's trust level (Autonomous / Monitored / Restricted / Quarantined), release a quarantined agent, and receive alerts, from anywhere. First pairing needs you on the same WiFi as the desktop so the handshake stays local; after that the encrypted relay path works over any network.
Yes, by design. Every remote command from the phone is Ed25519-signed by the paired device's key and replay-protected on the sidecar. Relay traffic is AES-256-GCM encrypted, the relay forwards opaque blobs it cannot decrypt. Per-device rate limits cap sensitive actions (5 trust changes per 10 minutes, 1 quarantine release per hour). Sensitive actions can be PIN-gated. Permissions can be scoped per device (view-only or full control). A local kill switch on the desktop disconnects any paired device instantly. Every accepted remote command is written to the tamper-evident audit trail with its device ID.
Encrypted blobs and opaque per-device IDs. Nothing else. State snapshots and alerts are encrypted on the sidecar with a key the relay doesn't hold; commands are signed by a key the relay doesn't hold. The relay cannot read prompts, responses, tool-call arguments, PII values, detection content, trust levels, or agent names. It cannot correlate devices to tenants or identify fleet membership, the identifier that crosses the boundary is a random 128-bit per-device token.
No. The mobile UI is a web app that works in any modern phone browser. Add it to your home screen for an app-like launch experience. A native app with push notifications is on the roadmap but not required for any v1 capability.
Home: a one-line health bar (uptime, requests inspected today, blocked today), a 0–100 security score with three sub-scores (trust posture, detection health, alert hygiene) and a trend arrow, three-up activity stats (Today / Week / Month), and the agent list with colored trust dots. Alerts: filter by severity / agent / category; per-alert Acknowledge, Quarantine, and Investigate (Investigate shows metadata only, time, agent, category, pattern, severity, verdict, never content). Agent detail: 24-hour activity sparkline, tool usage chips, trust-level selector. Settings: notification preferences (threshold, per-agent mute, quiet hours), tool-name anonymization toggle, disconnect device.
A floating action button on the home screen opens two emergency-grade commands. Run Test Battery fires the 24-payload adversarial spectrum through your local detection pipeline and surfaces results in your alert feed, useful to sanity-check detection from a hotel room. Pause All Agents quarantines every routable agent in one tap, with a confirmation dialog, for incidents where you want traffic stopped before you finish debugging. Both are signature-gated like any other remote command.
By default the remote state snapshot carries real tool names (Read, Bash, WebSearch) so the phone can show tool-usage counts meaningfully. If your agents use custom-named tools that could reveal the nature of your work (query_patient_database, stripe_refund), enable Anonymize tool names in Settings (desktop or mobile). Names are mapped to six generic buckets (file_read, file_write, shell, web, api_call, other) only at the snapshot boundary. The local agent_activity table and desktop dashboard always show the real names. Startup default is off; set CRAWDAD_ANONYMIZE_TOOLS=1 to enable at boot.
Nothing. The app has two transports in parallel, the direct HTTP path (used when your phone shares WiFi with the desktop) and the encrypted relay WebSocket (used everywhere else). If one goes down, the other takes over. Local state and the last-known alert feed are cached in the phone's IndexedDB, so the app renders immediately on every launch and fills in live data as the transports come back. Specifically: after a desktop reboot that changes the LAN IP, the phone races a 3-second direct probe and falls back to the relay automatically, never a blank screen. When both transports are offline the app shows a red banner ("Machine appears to be offline, showing last known state") above the cached content instead of going blank.
Yes. Tap the floating action button on the home screen and choose Run Test Battery. The phone sends an Ed25519-signed run_test_battery command; the sidecar kicks off the local test battery in a background task (same pipeline the desktop Run Test Battery button uses) and the resulting detections flow into your alert feed on both phone and dashboard within the next snapshot cycle.
Two new widgets replace the old static OWASP checklist: Agent Behavior Map (polls every 10s; per-agent trust dot, 5-minute activity sparkline, top tools in the last 5 minutes, last action + relative timestamp, anomaly indicator when volume exceeds baseline + 2σ or a detection fires) and Attack Pattern Intelligence (polls every 60s; 24h / 7d / 30d range selector, total blocked, ranked category bars with trend arrows vs. previous equal-length period, top patterns, new-this-period patterns highlighted, red-team-gaps link). Chart axis labels render in the viewer's local timezone; the sidecar still stores everything in UTC.
Fill out the form below and we'll get back to you.