Detection & response
Every credential was authorized. That's the problem.
Prevention decides who may act. Nightlatch watches what actually happened — tailing the broker's audit stream, enriching source addresses with risk intelligence, and answering the question the first two legs can't: is an authorized agent behaving like a compromised one?
Detections
Six questions, asked continuously.
Each detector is configuration, not code. They read the same audit stream your auditor would, and they fold into deduplicated findings rather than paging you once per matching event.
| Detector | The question it answers |
|---|---|
| high_risk_ip | Is an agent operating from an address scored hostile — a Tor exit, botnet command-and-control, or a drop-listed range? |
| new_source_ip | Did an agent appear from outside its learned address baseline? |
| velocity | A denial storm or token-mint storm — brute force, or a runaway loop? |
| dormant_awakening | Did a credential that idled for weeks suddenly come back to life? |
| event_match | Tripwires: revoked-credential replay, break-glass admin-key use, lockouts |
| off_hours | Activity outside the fleet's expected hours (off by default — it earns its keep only in some environments) |
Response
Run it in monitor for a week. Read what would have happened. Then decide.
A global mode gates every action. In monitor — the default — everything except logging is recorded as would_fire. Nothing touches your fleet until you say so, and what you turn on you can turn back.
log
A structured line, always safe, always on. The floor beneath every other action.
webhook
An HMAC-SHA256-signed JSON POST — to ntfy, a Slack shim, or a SOAR pipeline. Signed, so the receiver can tell a real finding from a forged one.
revoke_tokens
The circuit breaker: kill an agent's outstanding tokens through the broker's own API. The agent keeps its identity and can mint again once the cause is cleared.
revoke_agent
The heavier lever — revoke the agent itself. Reversible from the broker, because a detection product that can permanently destroy access is one nobody enables.
Findings, not alerts
Detections deduplicate into findings within a suppression window, carrying a capped evidence trail. One misbehaving agent is one thing to look at, not four hundred.
Acknowledge vs resolve
The lifecycle encodes intent. Ack means "seen — keep accumulating quietly"; repeats fold in silently. Resolve means "this is over"; a recurrence opens a fresh finding and fires actions again.
Why it needs a scoped key, not your master key. Nightlatch reads the audit stream and revokes agents — nothing more. Cipherlatch service keys exist because of exactly this: a machine principal carrying a role scoped to audit:read:all and agents:revoke:all, never platform admin. A watchdog should not hold the keys to the thing it watches.
Where it sits
Three products, one question each.
Prevention narrows what an agent may do. Intelligence says how hostile the source is. Neither can tell you that a perfectly authorized credential is being used by someone else — that is the third leg.
Cipherlatch
Decides who may act. Scoped, short-lived credentials brokered per request; the agent never holds a standing key.
riskd
Says how risky the world is. One normalized envelope from many feeds, cheap enough to ask on every request.
Nightlatch
Watches what actually happened, and reacts — the night watch for your agent fleet.