Skip to main content
DemoFictional data — for demonstration onlyBased on the actual system workflow
From a server join to an incident and back — with the tables that record each step
The workflow below reflects what the system actually does: observe activity, collect signals, form an incident, take an authorised action and restore the previous state. All numbers, identifiers and names are fictional. Exposing a real dossier would be the very abuse the network policy is designed to prevent.
Workflow
Five stages, each with a visible record
Every stage leaves its own database record, making it possible to reconstruct and challenge a decision later.
Join
AntiFakeEvent
A new account joins the server. The account module assesses its age, avatar, name pattern and how it joined. A risk score is an observation, not yet an incident.
Example: An account created 40 minutes earlier, with no avatar and a randomly suffixed name.
Signals
SecuritySignal
Each observation is recorded as a signal with a type, confidence, source and privacy class. A single signal has little meaning; several appearing together tell a clearer story.
Example: Six joins in 90 seconds, all with the same name pattern and using the same invite.
Incident
SecurityIncident
Signals of the same type within one time window form an incident with a severity and operating mode. The incident records its window, signal count and recommended action, which has not yet been executed.
Example: A join-wave incident: HIGH severity, 6 signals, a 90-second window and a recommendation to raise the verification level.
Action
ShieldSession / SecurityAction
New servers start in SHADOW mode: incidents are recorded and reported, but no action happens automatically. Execution requires the administrator to explicitly enable manual mode or limited automation.
Example: The administrator approves the action in the dashboard. The actor, time and grounds for the decision are recorded.
Recovery
ChannelPermissionSnapshot
Before permissions change, their previous state is saved. Lifting a lockdown can then restore the exact previous configuration.
Example: The wave ends after 12 minutes. Lifting the lockdown restores 14 channels’ permissions from the snapshot.
The flow is one-way up to stage 4: an observation cannot trigger an action without an incident, and an incident cannot bypass the mode chosen by the administrator. Stage 5 reverses the effects using the saved permission snapshot.
Security Operations Center
What the incident queue looks like
The operations view shows individual incidents with their severity, mode and signal count, so staff can assess whether a response is needed.
Fictional data — for demonstration onlyDemonstration server
| Type | Severity | Mode | State | Signals | Window | Notes |
|---|---|---|---|---|---|---|
| Join wave | HIGH | MANUAL | OPEN | 6 | 90 s | Six accounts with the same name pattern, using one invite. |
| Link spam | MEDIUM | SHADOW | OPEN | 3 | 4 min | The same shortened link posted in three channels. |
| Mass mentions | LOW | SHADOW | CLOSED | 2 | 2 min | Closed without action — the threshold was not reached. |
SHADOW mode means that an incident was recorded and reported without taking action. Every server starts this way. Automation begins only when the administrator explicitly allows it and sets its limits.
MSIoU dossier
What administrators can and cannot see
A dossier shows aggregate figures from servers the requester is authorised to access. It contains no message content or server names. The account in this example does not exist.
Fictional data — for demonstration only
przyklad_alfa · 100000000000000001
- Lookup scope
- 2 network servers out of 3 publishing servers
- Activity window
- 30 days
- Messages in the window
- 412
- Minutes in voice channels
- 1180
- Lookups for this person
- 3
- WARN2Both on a server publishing to the network
- MUTE1Expired
- BAN0None
Passport: Enabled by the user — server counts are visible, server names are hidden
What a dossier never contains
- Server names. Neither dossiers nor passports disclose where a person spends time, regardless of configuration.
- Message content. Only aggregate figures from a 30-day window are included.
- Data from servers outside the network. A server that does not publish contributes nothing to another server’s dossier, even when it uses the same bot.
- Cross-server disciplinary history after an opt-out. An opt-out restricts the view to the server where the lookup was made.
- Anonymous requesters. Every lookup records who requested it. That would also apply to this demonstration if it were performed in the product.
Details and source files: Trust Center .