Ideas · Builder Notes
Behavioural anomaly detection and machine-speed containment
Kognita alpha 0.5 builds per-agent baselines and automatically contains an agent on volume spikes, privilege probing or unusual tool sequences.
A human cannot react at the speed an agent misbehaves.
kognita.anomaly keeps per-agent baselines. Volume spikes, privilege probing and unusual tool sequences block the agent. Containment engages the kill switch, revokes the credential and stops tools, then alerts.
Each incident counts towards the circuit breaker, so containment feeds the wider control. Containment now happens automatically. Nobody has to find and follow a runbook.
Baselines are simple. False positives and tuning are open questions for the alpha.
Contain first, then alert. The alert is for the human; the containment is for the clock.
Sources
Kognita is an open-source alpha. This note comes from Kognita PR #59 in the Kognita repository.