TeoSlayer Pilot Watchdog
Real-time security monitoring for Pilot Protocol with anomaly detection, automated alerting, and threat response.
Commands
Initialize Watchdog
mkdir -p ~/.pilot/watchdog/{alerts,state}
cat > ~/.pilot/watchdog/config.json <<EOF
{
"enabled": true,
"check_interval_seconds": 30,
"rules": {
"connection_rate_limit": 10,
"failed_handshake_threshold": 3,
"queue_drop_threshold": 1
}
}
EOF
Monitor Connection Rate
# Detect abnormal connection rate
CURRENT=$(pilotctl --json connections 2>/dev/null | jq -r '.[].remote_hostname' | sort | uniq -c)
echo "$CURRENT" | while read -r COUNT AGENT; do
if [ "$COUNT" -gt 10 ]; then
echo "ALERT: $AGENT has $COUNT connections"
fi
done
Monitor Queue-Drop Counter
The daemon's health payload exposes queue_drops — when this is non-zero, the accept queue is overflowing (CPU saturation, fd limit too low, or DoS). Detect a regression by snapshotting and diffing.
STATE_FILE=~/.pilot/watchdog/state/queue_drops.txt
CURRENT=$(pilotctl --json health | jq -r '.queue_drops // 0')
PREVIOUS=$(cat "$STATE_FILE" 2>/dev/null || echo 0)
if [ "$CURRENT" -gt "$PREVIOUS" ]; then
DELTA=$((CURRENT - PREVIOUS))
echo "ALERT: queue_drops increased by $DELTA since last check (now $CURRENT)"
fi
echo "$CURRENT" > "$STATE_FILE"
Set Webhook for Events
# Configure daemon webhook
pilotctl --json set-webhook "http://localhost:8080/watchdog"
Workflow Example
Continuous security monitoring with automated responses:
#!/bin/bash
WATCHDOG_DIR=~/.pilot/watchdog
INTERVAL=30
mkdir -p "$WATCHDOG_DIR"/{alerts,state}
# Alert function
alert() {
echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) [$1] $2" | tee -a "$WATCHDOG_DIR/alerts/alerts.log"
}
# Monitor loop
while true; do
# Check connection rate
pilotctl --json connections | jq -r '.[].remote_hostname' | sort | uniq -c | \
awk '$1 > 10 {print $2}' | while read agent; do
alert "CONNECTION_RATE" "$agent exceeded connection limit"
done
# Check failed handshakes
PENDING=$(pilotctl --json pending | jq length)
if [ "$PENDING" -gt 5 ]; then
alert "HANDSHAKE" "High number of pending handshakes: $PENDING"
fi
sleep $INTERVAL
done
Dependencies
Requires pilot-protocol skill, pilotctl binary, jq, and running daemon.