Every packet.
Every network.
One WebSocket.
Signal Fabric is the real-time intelligence layer of Streaming Defense. Build security, observability, and response apps against a single enriched flow firehose — no collectors per network, no queues to operate, no log lag.
- fields per record
- 154
- median enrich
- <2 ms
- transport
- WSS
{
"event_time": "2026-05-08T18:42:11Z",
"organization": "acme-prod",
"probe_name": "edge-fra-01",
"source_ip": "185.220.101.45",
"destination_ip": "10.4.7.221",
"source_ip_country": "DE",
"destination_port": 443,
"application_protocol": "TLS",
"tls_ja4_fingerprint": "t13d1516h2_8daa…",
"tip_hit": 1,
"tip_best_type": "c2",
"tip_best_value": "malware-c2.xyz",
"tip_hit_max_severity_bp": 9200,
"risk_severity": "critical",
"record_unique_id": "01HZK…F7Q"
}Stop building plumbing.
Start building products.
Three things teams stop running the day they connect to the fabric. One thing they finally get.
No collectors per network
Streaming Defense probes capture flow at the network. You connect once, downstream — over a single WebSocket — to consume signal from all of them.
No message queue to operate
Skip Kafka, Kinesis, NATS, RabbitMQ. The fabric is the queue. Reconnect, replay, and back-pressure are handled at the edge.
No waiting on log files
Firewall logs arrive minutes late, parsed by a vendor. Hadron emits enriched flow records in real time, before damage compounds.
Enriched at source
Each record carries geo, ASN, nDPI category, TLS/JA4 fingerprints, and TIP matches across IPs, domains, and JA4s — already normalized.
Probes ingest. Hadron enriches. Your app consumes.
One persistent WebSocket carries control frames, threat detections, allowlist acknowledgements, and the full Hadron flow record.
Probes capture flow at the network edge.
Geo, ASN, nDPI, JA3/JA4, TIP matches.
Frames distinguished by type and action.
Stable fields, stable IDs, stable contracts.
Connect in nine lines. Route in five.
A WebSocket. A frame router. The full enriched record. That is the contract.
import WebSocket from "ws";
const ws = new WebSocket("wss://sdaot.globalthreatintel.com/ws/aot/", {
headers: { Authorization: `Bearer ${process.env.SIGNAL_FABRIC_TOKEN}` },
});
ws.on("message", (raw) => {
const frame = JSON.parse(raw.toString());
// 1. Control plane
if (frame.type === "performanceMetrics") return;
if (frame.action === "threatStream" && frame.type === "detection") {
return onDetection(frame.detection, frame.summary);
}
if (frame.action === "allowlist.result") return onAllowlistAck(frame);
// 2. Flow records — full Hadron schema
if (frame.tip_hit && frame.tip_hit_max_severity_bp > 7000) {
console.log("[high]", frame.source_ip, "→", frame.destination_ip,
frame.tip_best_type, frame.tip_best_value);
}
});Build your first app this afternoon.
Sandbox keys are free for developers. Connect, route, render. Most teams have a live map, a TIP feed, or a JA4 anomaly board running in under an hour.