Evidence first. Context always.
GriffinGuard intelligence is based on activity observed by its sensor network. It is intended to help security teams investigate and prioritize signals, not to identify an operator or prove intent.
From observation to investigation.
- 01
Collect observations
Edge-device honeypots record connection activity directed at the services they expose.
- 02
Normalize and deduplicate
Incoming events are prepared for analysis so repeated observations can be considered together.
- 03
Enrich
Available network and geographic context, tags, targeted ports, and fingerprints add detail to an observation.
- 04
Classify
Observed behavior and available context are used to assign one of GriffinGuard’s classifications.
- 05
Publish for investigation
The dashboard and API expose current records and activity summaries for analysts and security tooling.
Four labels. One shared vocabulary.
- Malicious
- Observed behavior meets GriffinGuard’s criteria for a malicious classification. Validate the evidence in your environment before taking action.
- Unknown
- There is not enough evidence to assign another classification. Unknown is not a clean bill of health.
- Institutional
- The observed address is associated with an identified organization or service. Consider the specific activity and context.
A classification is a signal for investigation, not a guarantee or a universal threshold for automated blocking. Use it alongside the underlying activity and your own response policy.
Observations are not attribution.
- Coverage reflects what GriffinGuard sensors observe; activity outside that view may not appear.
- An IP address may represent shared, reassigned, proxied, or compromised infrastructure.
- An absence of recorded activity does not establish that an address is safe.
- Records and classifications can change as observations and enrichment are updated.
- Review supporting context before blocking an address or automating a security decision.
Numeric confidence thresholds, enrichment-source names, sensor counts, event redaction rules and retention periods are not specified on this page until the data owner verifies them.