Detection & Deception Engineering in the Matrix (Orbie)

A practitioner talk by Bob Rudis and Glenn Thorpe (GreyNoise) at Unprompted (March 2026) on Orbie, an AI agent that operates over internet-scale honeypot data. Abstract-only; slides and video are not yet captured.

The Argument

Orbie surfaces emergent threats, identifies campaigns, and writes detection rules from GreyNoise’s internet-scale honeypot telemetry. The talk reports what works and what does not, and points to specific campaigns the agent caught that traditional methods missed. Its central claim is that domain-expert knowledge embedded in the tooling, not the choice of model, is what lets an LLM operate usefully over billions of network sessions.

Placement

Direct evidence for the detection-engineering capability in the Agentic SOC: State of the Field thesis: an agent that authors detection content from live telemetry, rather than a human writing rules against vendor libraries. It pairs with the Palo Alto SYARA semantic-detection talk and the Microsoft BinaryShield threat-intel-sharing talk as the detection cluster of the Unprompted agenda. The “domain knowledge in tooling beats model choice” claim is a useful counterweight to model-centric framings of agentic detection.