OrbitalGuard
Behavioral Intelligence Engine
OrbitalGuard watches what every entity in your ecosystem is actually doing — and flags when behavior diverges from what's expected. Runtime analysis, threat detection, anomaly scoring, code and malware classification. It doesn't care who you are. It cares what you're doing right now.
Identity tells you who something claims to be. Behavior tells you what it's actually doing. Most breaches happen with valid credentials. OrbitalGuard closes the gap between authentication and accountability by continuously scoring actions against expected patterns — across network traffic, LLM interactions, proxy connections, and attack surfaces.
Key Capabilities
Runtime Threat Detection
XGBoost classification on network traffic with sub-10ms response. Binary and multiclass attack detection — DDoS, port scans, botnet C2, brute force, lateral movement, data exfiltration. Behavior scored in real time, not after the fact.
Anomaly Scoring
Every entity gets a continuous behavioral score. Deviation from baseline triggers alerts, escalates incidents, or restricts access automatically. Works across humans, agents, devices, and services.
LLM Policy Enforcement
PII redaction, prompt injection blocking, cost tracking across Anthropic, OpenAI, Ollama, and local models. Policy enforcement before any token hits a model. Behavior-level guardrails, not just input filtering.
Code & Malware Classification
Static and behavioral analysis of code artifacts. Classify binaries, scripts, and payloads. Feed results into the anomaly scoring pipeline for correlated threat intelligence.
Attack Surface Orchestration
Session-managed orchestration of Nmap, Nuclei, Hydra for authorized security testing. Finding-tracked, correlated with behavioral data. Know your attack surface before adversaries do.
Unified Console
One dashboard for service health, behavioral analytics, traffic monitoring, and compliance assessment across ISO 27001, SOC 2, PCI DSS, GDPR, NIST CSF. Mobile incident management via Horus.
Components
OrbitalGuard is a suite of specialized services that work together via A2A protocol.
Pandora
XGBoost classification on network traffic. Binary + multiclass attack detection. DDoS, port scan, botnet C2, brute force, lateral movement, data exfiltration.
Chimera
LLM proxy with behavioral guardrails. PII redaction, prompt injection blocking, cost tracking, multi-provider (Anthropic, OpenAI, Ollama, local Qwen). Policy enforcement before any token hits a model.
Myrmidon
SOCKS5 proxy with LLM-powered error explanations and transaction correlation. Behavioral logging on every connection.
Cerberus
Attack framework orchestration. Nmap, Nuclei, Hydra — session-managed, finding-tracked. Feeds results into Guard's anomaly pipeline.
Horus
Mobile incident management. Alerts, incidents, behavioral anomalies — pushed to your phone for immediate response.
Console
One dashboard for everything. Service health, A2A agent discovery, behavioral analytics, traffic monitoring, compliance assessment across ISO 27001, SOC 2, PCI DSS, GDPR, NIST CSF.