Quick lookup

Reference

The compact version: key terms, module tables and links into the long-form pages. Use ⌘K anywhere on the site to search the full documentation.

Terms Glossary Core, detection, architecture, scoring and operations vocabulary. 5 sections Workarounds Known Issues Current limitations and the historical bugs that were fixed. Current + historical Planning Roadmap Near-, mid- and long-term direction, including the ML decision. 3 horizons History Changelog Detection, routing, pooling and security changes. Unreleased + historical Sources Literature Academic foundations and technical references for the stack. Academic + technical GitHub Source repository The private repository with the Lua modules, deployment files, dashboard and manual. github.com/iairu

Key Terms

Term	Definition
Honeypot	Decoy system designed to attract and engage adversaries
IDS	Intrusion Detection System — Suricata network IDS
SIEM	Security Information and Event Management — Elasticsearch/Kibana
CVE	Common Vulnerabilities and Exposures identifier
WSTG	OWASP Web Security Testing Guide category system
SID	Suricata rule identifier
Risk Score	Accumulated threat score (0–100) from the detection pipeline
Honeypot Threshold	Minimum score (default 80) triggering honeypot routing
Decay	Exponential reduction of stored risk scores over time
Permaflag	Score stops decaying entirely (repeat offender)
Honeytoken	Fake credential planted in honeypot responses
GDPR Signature	Privacy-preserving one-way hash of browser characteristics
Sophistication Class	scripted / ai_assisted / manual / unknown, with confidence
Pool	Isolated honeypot environment per user session
Honeypot Layer	Reverse-proxy (decoy pools) vs database (DB swapped per request)
Pure Module	Lua module with no ngx.* dependency, unit-testable
Adapter Module	Lua module performing I/O, delegating to pure modules

Default Thresholds

Setting	Default	Meaning
`honeypot_threshold`	80	Score at or above which a session is diverted.
`max_risk_score`	100	Hard cap on accumulated score.
`score_decay_half_life_seconds`	300	Base half-life; 0 disables decay.
`decay_offense_slowdown`	0.75	Half-life multiplier per offense.
`permaflag_offenses`	5	Offenses at or above this stop decay.
`permaflag_score`	100	Peak score that stops decay.
`ip_reputation_cap`	10	Reputation contribution on shared addresses.
`STATIC_POOL_COUNT`	3	Always-on pools declared in compose; the manager builds runtime pools above this.
`POOL_SPARES` / `POOL_MAX`	1 / 10	Warm spare pools / hard pool ceiling.
`POOL_IDLE_TIMEOUT_SECONDS`	1800	Idle window before scale-down.

Full definitions and cross-links live in the glossary; pool budget details are on the Engine page.

Repository

The implementation, deployment files and long-form manual live in the private repository. The documentation links to the relevant module or script for every behaviour it describes.

github.com/presshaven/presshaven