How to Read the PYNTIX Dashboard
A plain-English walkthrough of the kinetic threat intelligence engine — what each directive, metric, and result means, plus how to read the threat origin map.
What Is PYNTIX
Explain Like I'm 5
PYNTIX watches your network traffic and tells you whether it's safe, suspicious, or under attack. You give it the current traffic level and the normal level, and it figures out whether the spike is a real threat or just a busy day — then tells you to ALLOW, MONITOR, or BLOCK it.
Technical
PYNTIX is a kinetic anomaly detection engine that ingests network throughput data and outputs an absolute threat directive. It reads the deviation of current throughput from the planned baseline, the structural mass of the reading, and the rate of change (velocity) to classify the traffic signature. When the velocity and momentum cross a kinetic threshold, the engine flags the traffic as a volumetric attack or exfiltration signature — before the spike escalates.
Inputs
The engine needs a few fields to classify your traffic. Here's what each one means:
Reading the Result
After you submit a reading, the engine returns a structured result. Here's what each part means:
The Three Directives
ALLOW
Green. Normal flow — traffic is within parameters. No action needed. The spike velocity is within the volatility floor.
MONITOR
Yellow. Elevated threat — traffic is trending above baseline. Watch this endpoint more closely. The spike is forming but hasn't crossed the critical threshold yet.
BLOCK
Red. Critical intrusion — volumetric attack or exfiltration signature detected. Block the traffic at the firewall immediately. The kinetic index has crossed the circuit breaker.
Engine Metrics
The engine computes three core metrics from your input. Together they form the threat signature:
Spike Velocity
The percentage deviation of current throughput from the baseline. A high spike velocity means the traffic surged rapidly — the signature of a volumetric attack.
Structural Mass
The structural weight of the throughput reading. Higher mass means the traffic level itself is significant — a large volumetric event carries more mass than a small one.
Threat Index
The combined intensity that rises when mass and deviation intersect. This is the number that determines whether the traffic is ALLOW, MONITOR, or BLOCK.
Classification Rules
Every reading is classified by exactly one rule — this is your audit trail. Each directive is traceable to a specific classification.
Geo-Origin Mapping
When you provide a source IP, the engine resolves it to a geographic location and plots it on the threat origin map. This helps your team see where attacks are coming from — not just that they're happening.
Geo-IP Resolution
Country, city, latitude, and longitude resolved from the source IP. Private IPs return no location.
Threat Origin Map
Each flagged reading is plotted on the map. Clusters reveal coordinated attack origins and repeat offenders.
Practitioner Workflow
When using PYNTIX to monitor your network, follow this sequence:
Set the Baseline
Enter the normal expected throughput for the network or endpoint you're monitoring. This is the reference point the engine measures deviation against.
Ingest the Current Throughput
Enter the live traffic level — or let your monitoring bridge feed it automatically. Include the direction (inbound/outbound) and source IP if available.
Read the Directive
Check the colored bar: green = allow, yellow = monitor, red = block. The directive is absolute — the engine doesn't hedge.
Check the Response Levels
If the directive is MONITOR or BLOCK, review the threshold, stabilization target, and circuit breaker. These tell your team exactly when to act.
Review the Threat Map
If you provided a source IP, check the threat origin map. Clusters of flagged readings from the same region indicate a coordinated attack.
Acknowledge and Act
For MONITOR and BLOCK directives, acknowledge the alert and take the recommended action. The audit trail records who acted and when.
Ready to run the engine?
Go back to the dashboard and ingest a traffic reading to see the engine classify your threat signature.
PYNTIX is a kinetic anomaly detection tool, not a substitute for a dedicated firewall or IDS. All directives are mathematical projections based on throughput deviation and trajectory. Not a substitute for operational security judgment.