Partnership Synthient × nano
See through the proxy. Pin the adversary.
Modern attackers don't spray login endpoints or exfiltrate data from conspicuous datacenter clouds. They hide behind commercial residential proxies, compromised IoT nodes, and rotating VPN relays that masquerade as everyday ISP subscribers. Traditional SIEMs drown analysts in false positives from remote workers while missing the real threat.
Synthient unmasks proxy networks, scores behavioral IP risk, and correlates real-world attacker scans from its global Helios honeypot sensors. nano lands that context in ClickHouse: sub-second lookups over billions of events, detections as code, and AI-led triage that solves alert fatigue.
auth.login 185.220.101.5 risk=92 residential_proxy 14:59:22 okta.admin jsmith clean_isp (risk=0) helios.sensor HTTP exploit JA4=t13d1516h2 api.key POST /v1/tokens vpn_exit (Mullvad) synthient.lookup 194.26.29.114 → nano.clickhouse net.flow 24.199.120.4 suppressed (clean) auth.login 185.220.101.5 risk=92 residential_proxy 14:59:22 okta.admin jsmith clean_isp (risk=0) helios.sensor HTTP exploit JA4=t13d1516h2
pivt: adversary rotating residential pool cluster=14_ips clickhouse.insert ocsf.auth rows=8,192 14:58:10 ssh.bruteforce provider=BrightData synthient.firehose proxies:new_feed +3,400 rows stealer_log: credential matched infection sev=crit pivt: adversary rotating residential pool cluster=14_ips clickhouse.insert ocsf.auth rows=8,192 14:58:10 ssh.bruteforce provider=BrightData
rule.fire: distributed_credential_spray ALARM synthient.edge query_duration=2.8ms case #2904: auto-assigned to pivt triage entity.ip: cumulative risk score escalated → 94 helios.tls: JA4T match active Kimwolf botnet rule.fire: distributed_credential_spray ALARM synthient.edge query_duration=2.8ms
LIVE · Real-time IP intelligence streaming into nano
Synthient exposes the true identity behind every IP. nano makes it queryable and actionable across your entire security posture.
residential proxy unmasking· 0-100 behavioral risk score· Helios honeypot correlation· ClickHouse columnar queries· zero per-GB penalty
fig 01 · Continuous IP intelligence flowing from Synthient into nano's ClickHouse engine.
Why together Two halves of modern IP defense.
Synthient owns threat intelligence at the network edge: identifying proxy providers, mapping compromised consumer hardware, scoring behavioral risk, and observing active adversary decoys. nano owns the detection and response lifecycle: lightning-fast search over historical telemetry, rules as code, and AI investigation from alert to closed case.
· ground truth on every IP Attribute, score, correlate, detect.
01 Residential proxy attribution: identifies commercial proxy networks (Bright Data, Oxylabs, Smartproxy) and hijacked consumer devices.
02 Behavioral 0-100 risk scoring: real-time assessment based on device clustering, anomaly density, and active attack posture.
03 Helios honeypot network: correlates queries with active attacker scanning, HTTP probes, JA4 fingerprints, and botnet campaigns (e.g. Kimwolf).
04 Stealer log correlation: flags endpoints linked to infostealer malware infections and compromised credential leaks.
lookup & feeds
· makes it actionable Search, detect, triage, close.
01 Sub-second ClickHouse search: query across billions of enriched authentication and network logs without query timeouts.
02 Detections as code: write deterministic rules triggering on proxy types, risk scores, and honeypot hits alongside user behavior.
03 AI triage with pivt: when rules fire, pivt parses the Synthient dossier, queries related entity sessions, and drafts the case narrative.
04 Entity risk timelines: risk accumulates on users, devices, and ASNs over time, unmasking slow-burn reconnaissance campaigns.
The data flow From raw connection to enriched SIEM intelligence.
Enrichment happens in-stream or at query time via fast ClickHouse dictionaries and Synthient's Edge API. Enriched fields land directly in columnar storage, queryable alongside standard OCSF schemas with zero ingest penalties.
01 · Telemetry Sources
auth · okta, entra id cloud · aws vpc, cloudtrail perimeter · waf, cloudflare network · suricata, zeek
02 · Synthient Engine
Lookup API (sub-5ms edge) Firehose (real-time stream) Helios sensor honeypot match Hourly Parquet snapshots
03 · nano SIEM
ocsf.auth & ocsf.network synthient.* enriched columns ClickHouse dictionaries detections as code · pivt triage fig 02 · End-to-end enrichment pipeline: raw events gain provider attribution and risk scores prior to storage.
Detections as code Surgical OCSF detection rules in nPL.
nano is built natively on OCSF (Open Cybersecurity Schema Framework) and authored in nPL (nano Pipe Language), our fast, SPL-like query syntax. No proprietary schema lock-in, no awkward database SQL. Pipe directly from standard OCSF classes through Synthient proxy attribution, statistical baselines, and automated entity risk scoring.
credential_access-ocsf / distributed_credential_spray_residential
OCSF 1.9 · class_uid=3002 SEV-1 · HIGH
metadata.log_source IN ("okta", "azure_ad", "auth_logs")
class_uid=3002 activity_id=1 status="Failure"
| where synthient.is_proxy=true
AND synthient.proxy_type="residential"
AND synthient.risk_score >= 75
| bin span=15m
| stats count as failed_attempts,
dc(user.name) as unique_users,
dc(src_endpoint.ip) as proxy_nodes
by synthient.provider, synthient.isp
| where unique_users >= 15 AND proxy_nodes >= 10
| risk score=85 entity=synthient.provider
factor="Distributed spray via commercial residential proxy pool"
| where unique_users >= 50
| risk score=95 factor="Large-scale residential pool spray"
| table time, synthient.provider, synthient.isp,
unique_users, proxy_nodes, failed_attempts,
risk_score, risk_factors initial_access-ocsf / session_hijack_anonymizer
class_uid=6003 SEV-2 · MED
metadata.log_source IN ("cloudtrail", "api_gateway")
class_uid=6003
| where http_request.http_method
IN ("POST", "PUT", "DELETE")
| where synthient.is_proxy=true
AND synthient.proxy_type IN ("vpn", "tor", "datacenter")
| lookup recent_user_sessions actor.user.name
OUTPUT last_isp, last_risk_score
| where last_risk_score <= 15
AND synthient.isp != last_isp
| risk score=80 entity=actor.user.name
factor="Admin action via proxy relay after clean session"
| table time, actor.user.name, src_endpoint.ip,
synthient.provider, synthient.proxy_type, risk_score command_control-ocsf / helios_honeypot_scanner_inbound
class_uid=4001 SEV-1 · HIGH
metadata.log_source IN ("firewall", "suricata", "zeek")
class_uid=4001
| where connection_info.direction="inbound"
| lookup synthient_helios src_endpoint.ip
OUTPUT is_active_scanner, ja4_fingerprint, attack_type
| where is_active_scanner=true
| stats count as probe_count
by src_endpoint.ip, dst_endpoint.port,
ja4_fingerprint, attack_type
| where probe_count > 0
| risk score=95 entity=src_endpoint.ip
factor="Inbound hit matched active Helios decoy sensor"
| table time, src_endpoint.ip, dst_endpoint.port,
ja4_fingerprint, attack_type, risk_score Alert hygiene Slashing false positives at the root.
Alert fatigue destroys security teams. Traditional SIEMs rely on binary blocklists and coarse IP geolocation, triggering alarms every time an executive logs in from home or an airport lounge. Synthient replaces guesswork with granular telemetry.
01 · The Remote Work Dilemma
Tell employees from intruders.
Remote staff switch dynamically between home broadband, cellular tethering, and co-working spaces. Legacy SIEMs fire "unfamiliar location" alerts constantly.
Synthient improvement: Low behavioral risk scores (risk < 15) on confirmed residential ISPs safely suppress baseline noise.
02 · Stale Blocklist Lag
Real-time feed, not week-old CSVs.
Adversaries rotate through residential IP addresses in minutes. By the time a traditional reputation vendor lists an IP, the attacker has already abandoned it.
Synthient improvement: Firehose streams and real-time proxy tracking unmask nodes as they come online, eliminating blind spots.
03 · Decoy Corroboration
Pre-attack evidence from Helios.
When an alert triggers, analysts waste 20 minutes cross-checking external threat feeds to determine whether an IP has exhibited malicious behavior elsewhere.
Synthient improvement: Direct hits from Helios sensors attach recent honeypot probe timestamps and JA4 signatures right into the alert.
In practice How pivt investigates with Synthient context.
When an alert fires in nano, pivt investigates first. Instead of presenting the SOC analyst with a bare IP address, pivt immediately pulls the Synthient intelligence record: network classification, proxy provider attribution, risk score, and honeypot corroboration.
The analyst doesn't tab out to WHOIS, IPinfo, or VirusTotal. The full story is already assembled with clear containment recommendations.
pivt investigation · Case #2904
AUTO-TRIAGED (3.8s) // Alert: Okta Auth Failure Spike > Token Mint
Entity: sarah.connor@acme.corp · Target: Prod AWS Token
Synthient Dossier · 194.26.29.114
Type: residential_proxy (Confidence 99.2%)
Provider: Decoy Proxy Network (Pool #18)
Risk Score: 94 / 100 (HIGH MALICIOUS)
Helios Hit: Decoy SSH scanner hit 22m ago (JA4=t13d15)
pivt verdict: Valid credentials tested across 18 residential proxy nodes. Logon succeeded at 04:18 UTC followed immediately by IAM role assumption. Confirmed residential adversary relay.
› Recommended action: Revoked Okta session · Quarantined AWS token · Added provider pool to watchlist.
The economics Enrich every event without the ingest tax.
Legacy SIEM vendors bill by the gigabyte, punishing you for appending valuable threat intelligence. nano runs on flat capacity, giving you freedom to enrich every single event.
01 · No Ingest Multipliers
Add context for free.
Adding 12+ Synthient fields (provider, ASN, risk score, honeypot match) expands telemetry footprint. On per-gigabyte pricing, your bill explodes. On nano, storage is flat capacity ClickHouse.
02 · Hourly Parquet Snapshots
Local joins in ClickHouse.
Sync Synthient's hourly snapshot feeds directly into ClickHouse dictionary tables. Lookups occur in memory at query time with zero API rate limits or network latency.
03 · Focus Hot Storage
Cut noise upstream.
Filter out known benign background telemetry before expensive ingestion, shrinking the hot cluster size while preserving a pristine audit trail in object storage.
×
Bring true IP context into your SIEM.
Stop drowning in false positive impossible travel alerts. Stream your authentication, proxy, and network telemetry into nano with Synthient enrichments today.
Read the Synthient docs · docs.synthient.com
Real-time proxy attribution · Helios honeypot intelligence · Sub-second ClickHouse detections
