Welcome to Signal Fabric

Signal Fabric started as an internal tool. We were tired of every detection project beginning the same way: stand up collectors, pick a queue, parse a vendor log, wait for someone to ship the schema.

One stream, every network

The fabric is the queue. You connect once over WebSocket and receive normalized flow records from every probe in your fleet — enriched at source with geo, ASN, nDPI category, TLS/JA4, and TIP matches.

ts
import WebSocket from "ws";

const ws = new WebSocket("wss://sdaot.globalthreatintel.com/ws/aot/", {
  headers: { Authorization: `Bearer ${process.env.SIGNAL_FABRIC_TOKEN}` },
});

ws.on("message", (raw) => {
  const frame = JSON.parse(raw.toString());
  console.log(frame.src_ip, "→", frame.dst_ip, frame.ndpi_category);
});

No collectors per network. No queue to operate. No log lag.