How Frabs Works

1. 1The sensor attaches to each VM's network interface and counts its outbound traffic in a Frabs-only nftables table.
2. 2Your protection settings are compiled into a signed policy that the sensor downloads. It checks the signature before using it.
3. 3When a VM crosses a threshold, the sensor reports it. Frabs opens or updates an incident and matches the VM to its customer.
4. 4Your rules decide what happens next: alerts, a rate limit, a ticket, or more. The sensor applies network actions within seconds.
5. 5When the VM goes quiet, timed actions lift themselves and the incident clears.

Fail-safe

If the sensor stops, its network changes are removed and traffic carries on, unless you chose fail-closed. See Safety Centre.