# Datasheet: Autonomous Cyber-Antibodies

## Product Overview
* **Tagline:** Active Honeynet & eBPF Immunological Patching
* **Recommended for:** SecOps, Kernel-level Security squads, and Critical Infrastructure defense.

---

## Core Differentiators
* **eBPF-Based Telemetry:** Graphs kernel thread execution patterns in real-time, detecting structural anomalies before they reach user-space applications.
* **Sub-Second Patching:** Automatically compiles and injects hot patches directly into running kernel threads without service reboots or container restarts.
* **Adversarial Honeytoken Routing:** Traps and diverts malicious payloads automatically into sandboxed quarantine environments (honeynets).

---

## System Requirements

### Hardware Specs
| Component | Minimum | Recommended (Production) |
|-----------|---------|-------------------------|
| **CPU** | 2 cores | 4+ cores (for high-volume network filtering) |
| **RAM** | 1 GB | 2 GB |
| **Disk** | 100 MB | 500 MB (for local threat telemetry logging) |

### Software & Environment
* **Supported OS:** Modern Linux kernels (>= 5.8) with eBPF support enabled (`CONFIG_BPF_SYSCALL=y`).
* **Privileges:** Requires root privileges (`CAP_SYS_ADMIN`, `CAP_BPF`, `CAP_NET_ADMIN`) to attach eBPF probes.
* **Dependencies:** LLVM/Clang (for on-the-fly BPF compilation), libbpf, bpftool.

---

## Security & Compliance Guardrails

### ⚠️ Strict Opt-in Policy
By default, Cyber-Antibodies operates in **Audit Only** mode. Active thread patching requires explicit, cryptographic opt-in from the customer administration console:
1. Administrator signs the active policy configuration with their private key.
2. The gatekeeper verifies the signature and updates the kernel daemon status.
3. System logs all patch events to an immutable append-only local ledger.

### Rollback Controls
Every hot-injected patch retains its original bytecode in memory. A single command (`cyber-antibodies rollback [patch-id]`) detaches the eBPF probe and restores original execution flow in under 5 milliseconds.