Reading the substrate panel

The Substrate tab shows the engine working, live. Nothing on it is decoration. This page says what each figure is, and what it tells you when it moves.

One rule runs through all of it: the product never accuses on a single observation. A finding needs several independent sensors to agree. Most of what follows exists to let you see that happen.

Words used on this page

The engine has its own vocabulary. Here is what each word means, in the order you will meet them on the tab.

Substrate: The AFKSecurity engine as a whole: the mesh, the sensors that feed it, and the rules that let it reach a decision.
Sensor: A part of the engine that watches one thing on your machine: files, processes, network, devices, persistence, and so on. What it sees becomes observations.
Observation: One fact reported by a sensor, such as a program starting or a file being renamed. On its own, an observation accuses nothing.
Mesh: The live network that holds observations and connects them. It lives in memory and is rebuilt from nothing at every start.
Unit: One point in the mesh, its basic building block. Depending on its role, a unit holds an observation, compares, connects, filters or tempers. The six roles are described below.
Link: A connection between two units. It is how one observation reaches another, for example a burst of renamed files and the program behind it.
Activation: How strongly a unit is engaged at a given moment. On the central view, it is the size of the point.
Beat: One cycle of the engine. The mesh advances sixty times per second.
Energy: The budget the mesh spends to keep its units alive. It is what stops the mesh from growing without limit.
Hypothesis: A named suspicion: ransomware, exfiltration, credential theft, resolution hijack or persistence. It rises only when several observations point the same way.
Sources, or provenance: The number of distinct sensors behind a hypothesis or a line of the log. Deduced steps do not count.
Refutation: What the engine takes back off a hypothesis when the facts do not hold together.
Resonance: The moment a hypothesis crosses its threshold. It then becomes a verdict that can trigger a response.
Verdict: What a line of the log concludes: normal, unusual, or a named finding.

Left column

Energy budget

The mesh runs on a budget. Every unit it keeps alive costs a little on every beat, and the budget is what stops it from growing without limit. When it runs low, the engine slows its own sensors.

The bar and the two numbers: Energy left over total capacity. The bar turns amber below 40% and red below 18%.
Used: Spent on the beat just finished. Upkeep of every living unit, plus the cost of any hypothesis currently resonating.
Recovered: Given back on that same beat by units that were emptied, recycled or put to sleep.
Load: Above 1, the mesh is spending more than it recovers and living on its reserves. It is shown in amber when that happens. Brief peaks are normal.
Gain: Below 1, more is arriving than can be examined at full attention, and the engine concentrates on the strongest signals. Amber below 0.90.
The badge: Ample, Nominal, Frugal or Critical. It names the regime the substrate has chosen for itself, not the state of your computer.

Load above 1 with a gain below 1 over a long period means the machine is busy, not that something is wrong.

Mesh

The mesh is the live state. Each point on the central view is one unit, its size follows how activated it is, its colour follows its role. Links are what lets one observation reach another.

Units and Links: How many exist right now. They rise as the engine learns the shape of your machine, and they are rebuilt from nothing at every start.
Active: Above the activation threshold on this beat. This is the part that is actually working.
Idle: Alive but quiet. They keep their content and cost almost nothing. The engine inhibits units before deleting them, so what they learned is kept.
Reserve floor: The number of free units the engine refuses to go below, followed by how many it has. A mesh with no reserve cannot react to anything new, so this floor is held even under pressure.

The six roles

Free: Available, can take any other role. Costs almost nothing, which is what makes holding a reserve affordable.
Memory: Carries an observation.
Compute: Judges what arrives: compares, evaluates. The most expensive role.
Link: Fills a missing connection between two pieces of logic.
Gate: Allows or blocks an activation passing through it.
Reflect: Goes back over what the mesh already holds and tempers it. It works from the state of the mesh, not from the sensors, and produces refutations. It is the only role that lowers a suspicion.

Reflection has its own colour, so its activity can be told apart from the rest.

Sensors

Each sensor shows its rate, a multiplier and a count. The rate is how many times per second it is meant to beat. The count is how many observations it has produced since the engine started.

The multiplier is its metabolism. At full speed it sits near 1 and tells you nothing. A value such as 0.42 means the sensor is running at less than half its rate because the mesh is under load.

Right column

Machine

Two figures on one line, and they are not the same figure. The first is your whole machine, the second is AFKSecurity's own share of it. They are kept apart so you can always answer the question that matters: is it us, or is it everything else.

Processes: Running right now.
Known programs: Programs the engine has learned as ordinary on this machine. A program seen for the first time is not accused for that reason alone.
Canaries: Files placed where nothing legitimate should touch them. Something that opens them in bulk has announced itself.
Decoys: The same idea applied to what an intruder goes looking for.
Network in and out: Current throughput on the machine, not ours.

Assessment

First line: whether someone is at the keyboard. The whole product is built around absence, so this line decides how much it is allowed to do on its own. It comes from the engine, not from the screen guessing.

User: Observations that are the direct result of someone using the machine.
Habitual: Seen before on this machine, at a normal rate.
Unusual: Out of the ordinary for this machine. Unusual is not guilty. It is the pile the engine looks at first.

Shown here if the product is running without administrator rights, since some processes cannot be inspected in that case.

Hypotheses

Five named suspicions, each with a percentage. The percentage is how far the mesh has moved towards that conclusion, not a probability of being attacked.

The percentage: It rises as independent facts agree with each other. Repetition alone does not make a suspicion stronger.
Sources: How many distinct sensors have fed it. Deduced steps do not count. The more independent the sources, the stronger the case.
Refutation: What the reflection units have taken back off. A large refutation next to a suspicion at 0% means the engine considered the suspicion and ruled it out.

Above a set threshold the hypothesis resonates and becomes a verdict that can trigger a response. Below it, it stays what it is: an open question, left visible.

Event log

The log reads in the order things happened and keeps that order. It is not sorted by priority, so an incident can be read in sequence.

The three filters remove lines from the screen and never from the log. The log on disk stays complete and sealed.

Priority: How important the line is.
Verdict: Normal, unusual, or a named finding.
Sensor: Which part of the engine wrote it.
Provenance: Carried by each line: the number of distinct sensors behind it. This is the number to read first when a line accuses something.

One last thing. Every number on this tab is read from the engine, never recomputed by the screen.

Questions about an indicator: support@afksecurity.online.