01 / OBSERVE
Collect the evidence
Hostile activity is captured from honeypots, web servers and other protected systems. The original observation is retained as evidence for subsequent analysis.
01 / HOW IT WORKS
From observation
to protection.
Pynblok turns raw hostile activity into intelligence and then into automated defensive action.
The process is continuous. New observations add evidence, evidence improves the assessment, and intelligence can drive decisions across the defensive infrastructure.
PYNBLOK PIPELINE
01 / OBSERVE
CAPTURE
02 / ENRICH
CONTEXT
03 / CLASSIFY
UNDERSTAND
04 / SCORE
ASSESS
05 / PROMOTE
IDENTIFY
06 / DEFEND
ACT
02 / THE PIPELINE
Six stages.
One intelligence process.
Each stage adds another layer of understanding, moving from an individual observation towards a decision that can protect the network.
03 / THE SIX STAGES
02 / ENRICH
Add context
Observations can be enriched with information such as geolocation, network ownership, autonomous systems, reputation and known infrastructure.
03 / CLASSIFY
Understand the activity
The activity is classified according to what the attacker is attempting to do. Multiple observations can also reveal patterns of behaviour.
04 / SCORE
Assess significance
Evidence is combined to produce an intelligence assessment. Factors such as attack type, frequency, network information, geography and other evidence can influence the result.
05 / PROMOTE
Identify infrastructure
Significant or persistent hostile activity can lead to wider infrastructure being identified for defensive action, rather than treating every address as an isolated event.
06 / DEFEND
Take action
Intelligence can be synchronised with defensive systems, allowing hostile infrastructure to be blocked before repeated activity reaches protected systems.
04 / CONTINUOUS INTELLIGENCE
The process
doesn't stop.
Every new observation has the potential to add to what Pynblok already knows.
Intelligence is not a one-time calculation. New activity, new evidence and new external information can change the assessment of an attacker or the infrastructure associated with it.
This means that the system can evolve its understanding over time rather than relying on a static list created once and then left unchanged.
05 / INTELLIGENCE TO DEFENCE
Intelligence becomes
useful when it can act.
Pynblok is designed to connect intelligence with the systems responsible for protecting the network.
Defensive decisions can operate at more than one level.
Individual hostile addresses can be blocked, while significant intelligence about wider infrastructure can support network-level defensive measures.
Depending on the deployment, intelligence can feed systems such as Cloudflare IP Lists, upstream firewalls and local firewall or IP-table controls.
This creates a path from an observation made by the honeypot to protection being applied across the network.
THE PYNBLOK APPROACH
Don't treat every attack
as an isolated event.