Offline Reporting

IBSR generates offline reports from traffic snapshots collected on a target host. There is no live analysis, no dashboard, and no real-time decision-making.

Status & Scope

IBSR reporting is early-stage.

It is currently intended for:

  • controlled pilots
  • evaluation and safety testing
  • validating whether inline enforcement could be safe

The reporting pipeline, outputs, and responsibilities may change as the system evolves. IBSR is not something you can rely on for protection.

Overview

The reporting pipeline is intentionally offline and unattended.

Two reporting workflows are supported. For pilots, vendor-generated reporting is the default. What does this mean? It means, you upload your jsonl files to a shared drive, like S3 and we’ll run the reports.

It will require some teamwork, co-ordination and solid communications between us. At no point are humans expected to monitor live output - no late nights!

Privacy

We don’t collect sensitive data, just packet counts, ports and ip addresses (inbound). We don’t share the data. And you’ll be uploading it to a private S3 folder.

Yes, we will delete it all after. If you don’t mind, we’ll keep the report.

Reporting Responsibility

Vendor-Generated Reporting (Pilot Default)

In the default pilot setup:

  1. The customer runs the IBSR collector on their infrastructure
  2. Raw snapshot files (.jsonl) are uploaded to a customer-owned S3 bucket
  3. Reports are generated by NullRabbit under agreement
  4. Final report artefacts are returned to the customer

In this model:

  • Customers do not run ibsr-report
  • Customers do not tune thresholds
  • Customers do not interpret results
  • The collector runs unattended once configured

Customer-Generated Reporting (Optional)

Customers may choose to generate reports themselves using ibsr-report.

This workflow is optional and intended for advanced users. It is not required for pilot participation.

Snapshot Collection

The IBSR collector writes traffic snapshots as .jsonl files.

Snapshots may be:

  • uploaded directly from the collector host, or
  • transferred to another system before upload

Example transfer:

rsync -avz user@collector:/var/lib/ibsr/snapshots/ ./snapshots/

Uploading Snapshots

See S3 Upload for installation and usage of ibsr-export.

Unattended Execution

IBSR is designed to run unattended once configured.

A typical pilot deployment:

  • the collector runs continuously
  • uploads occur on a schedule
  • failures are treated as failed jobs, not live incidents

There are no dashboards to watch and no logs to tail.

What IBSR Does Not Require

  • live monitoring
  • dashboards
  • alerting
  • manual inspection during runtime

IBSR produces artefacts. Those artefacts are the interface.

This site uses Just the Docs, a documentation theme for Jekyll.