01
Activity
What happened? The nature, frequency and characteristics of observed attacks provide the first layer of evidence.
01 / THREAT INTELLIGENCE
Understand the
attacker.
Pynblok looks beyond individual attacks to identify patterns, relationships and infrastructure.
Every observation is a piece of evidence. Pynblok combines those pieces to build an increasingly useful picture of hostile activity.
INTELLIGENCE MODEL
ATTACKS
EVIDENCE
NETWORKS
CONTEXT
BEHAVIOUR
PATTERNS
INFRASTRUCTURE
RELATIONSHIPS
ASSESSMENT
INTELLIGENCE
02 / BEYOND THE IP
One attack tells
only part of the story.
An IP address is an observation point — not necessarily the thing that matters.
The same infrastructure may be responsible for many different attacks, against different systems and at different times.
Pynblok retains those observations and looks for the relationships between them. Network ownership, autonomous systems, geographic information, attack characteristics and previous activity can all contribute to the picture.
This allows individual events to become part of a much larger body of evidence.
03 / EVIDENCE
Intelligence is
built from evidence.
Pynblok considers multiple dimensions of hostile activity rather than relying on a single indicator.
02
Infrastructure
Where does the activity originate? Networks, autonomous systems and related infrastructure provide additional context.
03
Behaviour
What does the activity reveal over time? Repeated observations can expose patterns that a single event cannot.
04 / INTELLIGENCE OUTPUT
From evidence
to assessment.
Pynblok brings accumulated evidence together into intelligence that can be examined and acted upon.
05 / INTELLIGENCE SCORE
Evidence can
change the assessment.
Pynblok uses accumulated evidence to assess the significance of hostile activity.
An isolated event may tell us relatively little. Repeated attacks, multiple attack classes, network information, geographic context and other evidence can provide a much stronger indication of hostile infrastructure.
The resulting intelligence score provides a way of distinguishing between different levels of concern and prioritising defensive action.
06 / NETWORK INTELLIGENCE
The network matters.
Hostile activity is rarely isolated from the infrastructure around it.
Pynblok can examine activity at more than the individual address level.
By considering networks and autonomous systems, it becomes possible to identify concentrations of hostile activity and recognise when apparently separate observations may belong to the same wider infrastructure.
This is important because effective network defence is often about understanding the infrastructure behind an attack — not simply reacting to the latest address seen.
Intelligence can therefore become useful beyond the original observation that generated it.
THE PYNBLOK APPROACH
Individual events become intelligence
when they are understood in context.