Detection & Deception Engineering in the Matrix (Orbie)

A practitioner talk by Bob Rudis and Glenn Thorpe (GreyNoise) at Unprompted (March 2026) on Orbie, an AI agent that operates over internet-scale honeypot data. Abstract-only; slides and video are not yet captured.

The Argument

Orbie surfaces emergent threats, identifies campaigns, and writes detection rules from GreyNoise’s internet-scale honeypot telemetry. The talk reports what works and what does not, and points to specific campaigns the agent caught that traditional methods missed. Its central claim is that domain-expert knowledge embedded in the tooling, not the choice of model, is what lets an LLM operate usefully over billions of network sessions.

Where It Fits

Direct evidence for the detection-engineering capability in the Agentic SOC: State of the Field thesis: an agent that authors detection content from live telemetry, rather than a human writing rules against vendor libraries. It pairs with the Palo Alto SYARA semantic-detection talk and the Microsoft BinaryShield threat-intel-sharing talk as the detection cluster of the Unprompted agenda. The “domain knowledge in tooling beats model choice” claim is a useful counterweight to model-centric framings of agentic detection.