Examples

The reports in this section are real captures from a production Sentry deployment — a target deliberately exposed to the internet. Each page is a post-incident report: what attacked, how the pipeline detected it, which verdict was enforced, and what forensics confirmed afterwards. Attacker IPs are partially masked, exactly as published.

None of this is lab traffic: these are live worms, scanners and probes from the public internet, caught by the same heuristics, rule packs and body inspection that run in any Sentry deployment. Scores, timestamps, signal weights and metrics are reproduced exactly as captured.

The reports

Report	Scenario	What it demonstrates
Mozi: RCE attempt	Mozi worm tries a NetGear router command injection (setup.cgi?todo=syscmd)	CmdInjection heuristic + inline edge block (403) + 24h blocklist ban (ip_state) + automatic incident + clean forensics
Mozi worm propagation	The same worm returns from a different infected host, download URL pointing at the attacker's own IP	Host-to-host worm propagation (C2 embedded in the payload), layered TCP + HTTP telemetry, identical detection across independent infections
Distributed MCP/SSE scanner	25 IPs probe AI infrastructure (MCP/SSE), one probe per IP to dodge per-IP rate limits	bad_crawler rule pack (curated User-Agent dataset) on the reputation fast path: 25/25 scored 100, blocked and banned
RCE via upload form field	Command injection hidden inside a multipart form field's content	Request-body inspection (F10): multipart parser + upload_content heuristic, with zero body bytes persisted

Original files

The full reports, in their original form, live in the examples/ directory of the main repository:

• incident-report-mozi-rce.md
• incident-report-mozi-propagation.md
• incident-report-mcp-scanner.md
• incident-report-upload-field-rce.md

Related reading

• Rules Engine — rule packs, reputation fast path and DSL
• Architecture — request flow and risk levels