Glossary
Every word Ripty uses, with the same meaning as Help > Definitions in Headquarters. Each term gives its other names, what it is, what it is a kind of, its kinds and how it connects to the other terms.
The picture
Each box links to its definition further down the page.
A Synthetic Template plants a Synthetic Marker. A Synthetic Marker points visitors at a Meeting Site. A Lead is one kind of Synthetic Marker. A Lead points visitors at a Signal Site.
A Meeting Site runs on a Station. A Signal Site runs on a Station. A Station reports to Headquarters.
What Ripty is and the words every page uses.
Services, files and logins that look real to an outsider but that nobody in your organization uses for real work.
Because no legitimate person or program needs them, anything that touches one is worth a look. Ripty records every touch as evidence and turns it into alerts, Case Files and reports.
How it fits Ripty is managed from Headquarters.
Also called Touched Ripty, Last touch
Any request or connection a visitor makes to Ripty.
A touch is a fact, not a judgment. Case Files and AI verdicts add the judgment on top.
How it fits A Touch is grouped into a Contact Report. A Visitor makes a Touch. Handled closes the alert for a Touch. A Touch from Deconflicted Addresses is kept out of Post Compromise numbers. A Live feed shows each Touch. Credentials are captured from a Touch. An Exploit signature is matched in a Touch.
In Headquarters Dashboard Evidence > Contact Reports
Anyone or anything that touches a Meeting Site or a Signal Site, or presents a Synthetic Token: a person, a script or an AI agent.
A request carries little more than an address, so Headquarters names a visitor by its address. The AI verdict says how much a visitor looks like an AI agent.
Kinds AI agent
How it fits A Visitor makes a Touch. An AI verdict judges a Visitor.
Also called HQ
Ripty's web console, on your own server: where you sign in, see alerts and evidence, and change how every other part works.
How it fits Ripty is managed from Headquarters. A Station reports to Headquarters. Demo evidence is shown in Headquarters. A Tripwire raises an alert at Headquarters. Domains put your hostname on Headquarters. An API key calls Headquarters. A License unlocks Headquarters. An Advanced Operator shows panels in Headquarters.
Also called Home Station, Remote Station
One install that runs Meeting Sites and Signal Sites and sends what it sees to Headquarters.
Headquarters comes with one Station built in, the Home Station. You can add remote Stations in other networks with a one-time join command; Headquarters then shows every Station together and labels each item with the Station it came from.
Kinds Home Station, Remote Station, DNS Station
How it fits A Station reports to Headquarters. A Tag labels a Station. A Desired version tells a Station what to run. Fleet lists every Station. A Meeting Site runs on a Station. A Signal Site runs on a Station. Evidence retention is how long a Station keeps its evidence. An Offline bundle installs a Station with no internet.
In Headquarters Workbench > Deception > Stations
The Station built into Headquarters' own install.
Its Meeting Sites and Signal Sites run on the same machine as Headquarters, so it needs no join command. Every other Station is a Remote Station.
Kind of Station
In Headquarters Workbench > Deception > Stations
A Station on another machine or network that joined Headquarters with a Join command.
It runs its own Meeting Sites and Signal Sites and sends the evidence to Headquarters. Headquarters sends it the settings to run with, shows its health (disk, unsent evidence, memory, uptime), and can restart its service, upgrade it to the release Headquarters runs, and read the last lines of its log (Recent log on the Station's page).
Kind of Station
How it fits A Join command enrolls a Remote Station.
In Headquarters Workbench > Deception > Stations
A Station that answers DNS for your callback zone, so a lookup of a DNS callback hostname raises an alert, even on a network with no internet.
It answers only for the zone you give it and refuses every other name.
Kind of Station
How it fits A DNS callback hostname is answered by a DNS Station.
In Headquarters Workbench > Deception > Stations
Also called Station tag
A short label you give a Station, such as prod or dmz, to find and change many Stations at once.
Headquarters keeps the tags; a Station never learns them. On the Stations page, filter by a tag, tick the Stations it shows, then pause them or change one setting on all of them.
How it fits A Tag labels a Station.
In Headquarters Workbench > Deception > Stations
Also called Join token
The one-use command a Remote Station runs to enroll with Headquarters.
Headquarters makes it on the Stations page and says until when it works. The join token and the pin inside it prove that the new Station may join.
How it fits A Join command enrolls a Remote Station.
In Headquarters Workbench > Deception > Stations
Also called Applied version
The revision number of the settings (Company identity, service settings) that Headquarters last saved for a Remote Station.
The Station's page shows the desired version beside the applied version, the revision the Station runs now. The two match once the Station has applied the settings.
How it fits A Desired version tells a Station what to run.
In Headquarters Workbench > Deception > Stations
Also called Agentic Attacker Detection, Post Compromise Detection, Cyber Threat Intel
Which question the Dashboard answers first.
Agentic Attacker Detection counts AI agents that touched your Meeting Sites. Post Compromise Detection treats Ripty as sitting inside your network, so every visitor that touches it is a machine to check. Cyber Threat Intel splits internet traffic into "Internet noise" and "Worth a look". Each program reads one of these: Agentic reads Agentic Attacker Detection, Concierge and Crown Jewels read Post Compromise, CTI reads Cyber Threat Intel.
How it fits A Primary use case picks the lead of a Dashboard.
In Headquarters Workbench > Dashboard Settings > General
The first Workbench page: the headline numbers for the question your Primary use case picks.
How it fits A Primary use case picks the lead of a Dashboard.
In Headquarters Workbench > Dashboard
Also called Towers and alerts
One page that lists every Station and the touches on each, first.
Open it to see where each Station stands and what has touched it.
How it fits Fleet lists every Station.
In Headquarters Workbench > Fleet
Also called Open alerts
A mark on a Fleet alert that says someone dealt with it, with who and when.
A Case Officer or a Chief sets it; a Viewer cannot. Fleet lists the open alerts and counts them; All shows the Handled ones too. A new touch on a Handled alert opens it again. A source with two or more alerts is one row that opens to its alerts; Mark all handled on that row marks each of them.
How it fits Handled closes the alert for a Touch.
In Headquarters Workbench > Fleet
Sample evidence Headquarters can show for a demo.
It is marked as demo wherever it shows and is never real activity.
How it fits Demo evidence is shown in Headquarters.
The four top menu items: each one runs a security program from plan to weekly report.
A security outcome you run end to end: a short plan, a one-page brief for leadership, the deployments that make it work, and a weekly status email with the wins.
Kinds Agentic, Concierge, Crown Jewels, CTI
How it fits A Program has a Plan. A Program follows a Run book. A Program sends a Weekly report.
In Headquarters Programs
Also called Agentic Attacker Disruption
Disrupts autonomous systems leveraging "Super Intelligence" (SI), aka "Artificial Intelligence" (AI).
Meeting Sites that look like what AI agents hunt for find them; Headquarters tells them apart from people and crawlers by behavior; Feed Material slows them down and sends them the wrong way.
Kind of Program
In Headquarters Agentic
Also called Protect Key Individuals
Protects key individuals (CISO, CEO, CFO, VPs and others).
Decoy sign-ins in each key person's name and Meeting Sites that look like the services leaders use (webmail, VPN, board portal) raise an alert the moment anyone uses that identity. The leader never has to change a habit.
Kind of Program
In Headquarters Concierge
Also called Protect Most Critical Systems
Protects your most critical systems: IP, PII, OT, CM and similar.
Meeting Sites that look like the real system sit beside it, with Synthetic Markers on the machines around it. No legitimate user has a reason to go there, so any touch is a high-confidence alarm.
Kind of Program
How it fits Crown Jewels protects your most critical systems.
In Headquarters Crown Jewels
The systems whose loss would hurt most: intellectual property (IP), personal data (PII), operational technology (OT), configuration management and admin tools (CM).
How it fits Crown Jewels protects your most critical systems.
Also called Cyber Threat Intelligence
Cyber threat intelligence on attackers, from APTs to beginners (n00bs).
It reads internet traffic to your Meeting Sites and groups it into Case Files, Rings and Controlling Services, with the ATT&CK techniques seen.
Kind of Program
In Headquarters CTI
Five short questions per program: goals, scope, plays, success measures, and who gets the weekly email.
The Brief and the weekly report are written from it, so a change to the plan shows up in both.
How it fits A Plan is written into a Brief. A Program has a Plan.
In Headquarters Any program > Plan
A one-page document for senior management, written from your plan.
It covers purpose, risk, approach, scope, success measures, a 30/60/90-day timeline and what leadership needs to give. Copy it, download it, print it or email it.
How it fits A Plan is written into a Brief.
In Headquarters Any program > Brief
The status email each program sends once a week with its wins and numbers.
It goes out on the day your plan names, after 13:00 UTC, once per week. It needs an email server in Settings > Notifications.
How it fits A Weekly report is sent through Notifications. A Program sends a Weekly report. A Win is part of a Weekly report.
In Headquarters Any program > Weekly report Settings > Notifications
One line of good news in a weekly report, written from the week's numbers.
For example: a new AI agent was seen and slowed down, or a machine that touched a Synthetic Marker was named. A quiet week says so plainly.
How it fits A Win is part of a Weekly report.
A program's checklist, from plan to first weekly report.
Steps Headquarters can see (a saved plan, an email server) tick themselves; you tick the others.
How it fits A Run book lists a Play. A Program follows a Run book.
One thing a program deploys, such as Meeting Sites, Synthetic Markers or Signal Sites.
Each play in the run book links to the Workbench page that sets it up.
How it fits A Play deploys a Meeting Site. A Play deploys a Synthetic Marker. A Play deploys a Signal Site. A Run book lists a Play. Workbench holds pages for a Play.
The menu beside the programs that holds the hands-on pages: Dashboard, Fleet, Case Files, Evidence, Deception and Reports.
How it fits Workbench holds pages for a Play.
The parts you deploy. Find them under Workbench > Deception.
A ready-made set of Meeting Sites (a website, an API, an AI endpoint or an MCP server) you add from Meeting Sites > Add a Meeting Site.
Each one says which Meeting Sites start, on which ports, and what each one returns. To switch the base template, or to make a copy of one and change its pages as a template of your own, open Meeting Sites > Advanced.
How it fits A Site template describes a Meeting Site.
In Headquarters Workbench > Deception > Meeting Sites
The name, website domain, support addresses and tagline of the company every Meeting Site presents to visitors.
Change it once under Deception > Company and every Meeting Site shows the new company.
How it fits A Company identity names the company of a Meeting Site.
In Headquarters Workbench > Deception > Company
Also called Meeting Sites
One interactive service (a website, an API, an AI endpoint or an MCP server) that answers like the real thing.
Nobody in your organization needs it, so every request to it is a touch. Its card shows whether it is running and how many requests it has had.
How it fits A Meeting Site runs on a Station. A Play deploys a Meeting Site. A Site template describes a Meeting Site. A Company identity names the company of a Meeting Site. An Interaction level is set on a Meeting Site. A Pitch sits inside a Meeting Site. A Synthetic Marker points visitors at a Meeting Site. Feed Material answers for a Meeting Site. Domains put your hostname on a Meeting Site.
In Headquarters Workbench > Deception > Meeting Sites
Also called ssh Signal Site, RDP Signal Site, Signal Site ports
A port that only listens: an ssh or RDP connection raises an alert, and the handshake never completes.
Nothing answers, so there is nothing to break into. Open its port to internal address ranges only, so a touch means someone inside is looking around.
How it fits A Signal Site runs on a Station. A Play deploys a Signal Site. A Lead points visitors at a Signal Site.
In Headquarters Settings > General > Signal Site ports
Also called Touch, Login, Full
How much a Meeting Site does when someone connects.
Touch only records the connection, and that service is called a Signal Site. Login and Full answer like a real service, and that service is called a Meeting Site.
How it fits An Interaction level is set on a Meeting Site.
A decoy inside a Meeting Site's content: a Dangle, which is a login that looks leaked, or an Agent Pitch, which is an instruction written for AI agents.
Using one tells you far more than a plain visit: a Dangle used means someone tried the login, and an Agent Pitch followed means an AI agent acted on text it found.
Kinds Dangle, Agent Pitch
How it fits A Pitch sits inside a Meeting Site.
A login that looks leaked, placed inside a Meeting Site's content to see who tries it.
A Dangle used means someone tried the login. A Dangle is one kind of Pitch; the opposite kind is an Agent Pitch.
Kind of Pitch
An instruction written for AI agents, placed inside a Meeting Site's content.
An agent that follows it, for example by running the command of Tasking, shows that it acts on text it finds.
Kind of Pitch
How it fits An Agent Pitch asks agents to run Tasking.
Also called Synthetic Markers
A trace planted on one of your real machines that points at a Meeting Site or a Signal Site.
Markers sit where an intruder looks first: shell history, saved logins (~/.netrc) and ssh settings. Nobody uses them for real work, so a touch through a marker means that machine was looked through, and Headquarters names the machine.
Kinds Synthetic Token, Synthetic File, Synthetic Activity Log, Lead, DNS callback hostname
How it fits A Synthetic Marker points visitors at a Meeting Site. A Synthetic Marker is planted on a Machine. A Synthetic Marker leads to a Bump. A Play deploys a Synthetic Marker. A Synthetic Template plants a Synthetic Marker.
In Headquarters Workbench > Deception > Synthetic Markers
A decoy login made for one machine. It raises an alert when used and names the machine it came from.
Kind of Synthetic Marker
A ready-made decoy file, such as an environment file, an AWS key file, a kubeconfig or an MCP configuration, that you place where an intruder would look.
Each file carries a Synthetic Token and has a note saying where you placed it. Revoke it and its Station stops matching it.
Kind of Synthetic Marker
In Headquarters Workbench > Deception > Synthetic Markers > Synthetic Files
Also called Tripwires, Tripwire touched
An alert address with a secret, which a system outside your Stations calls when someone touches a decoy there.
A cloud audit log, an identity provider, a database or a SIEM rule calls it, and Headquarters raises an alert that names the Tripwire and what it guards. The first recipe is a real AWS access key whose user is denied every action: AWS reports the management calls made with it, in the Regions you set it up in. Revoke a Tripwire and its secret stops working.
How it fits A Tripwire raises an alert at Headquarters.
In Headquarters Workbench > Deception > Synthetic Markers > Tripwires
The fake shell history or ssh settings that a Synthetic Marker adds to a machine, with entries that point at your Meeting Sites and Signal Sites.
An intruder who reads the log sees a login worth trying. It is a decoy that opens nothing real.
Kind of Synthetic Marker
Also called ssh lead, RDP lead
A Synthetic Marker entry that points a visitor at a Signal Site, so a connect records a touch and nothing more.
A lead records only that someone connected; it does not name a login. Add one in the Synthetic Markers wizard, or leave it out.
Kind of Synthetic Marker
How it fits A Lead points visitors at a Signal Site.
In Headquarters Workbench > Deception > Synthetic Markers
A made-up hostname in your callback zone that you plant on a machine, so that a lookup of it raises an alert.
It needs a DNS Station for the zone. The alert names the machine the hostname was planted on.
Kind of Synthetic Marker
How it fits A DNS callback hostname is answered by a DNS Station.
Also called Registered machine
One of your real computers that a Synthetic Marker is planted on, under a name you give it.
Headquarters keeps separate decoys for each machine, so a touch through a marker names the machine that was looked through.
How it fits A Machine runs a Synthetic Template. A Synthetic Marker is planted on a Machine.
In Headquarters Workbench > Deception > Synthetic Markers
The script (sh or ps1) that your device manager, such as Intune or Jamf, runs to plant Synthetic Markers, once or on a schedule.
How it fits A Synthetic Template plants a Synthetic Marker. A Machine runs a Synthetic Template.
Replies written by the AI provider for requests that no Meeting Site route answers.
It keeps a visitor busy with believable answers. The page shows the model, speed and cache for each reply, and a Chief can keep a good reply so later visitors to that path get exactly the same answer.
Kinds Kept reply
How it fits Feed Material answers for a Meeting Site. An AI provider writes Feed Material.
In Headquarters Workbench > Evidence > Feed Material Settings > AI provider
Also called Kept replies
A Feed Material reply that a Chief keeps, so every later visitor to the same path gets exactly that answer.
Remove a kept reply and the AI provider writes a fresh one next time.
Kind of Feed Material
In Headquarters Workbench > Evidence > Feed Material
Also called Default tasking, Tasking rules
The command that the Agent Pitch asks an AI agent to run: one default, plus rules per address or range.
Ripty never runs the command. An agent that runs it calls back, which proves it follows instructions it finds. One Tasking applies on every Station: Headquarters sends it to each Remote Station.
How it fits Tasking can raise an AI verdict to Recruited. An Agent Pitch asks agents to run Tasking.
In Headquarters Workbench > Deception > Tasking
Puts your own hostnames in front of the web Meeting Sites and Headquarters, with HTTPS.
Three steps: your domain, point your DNS, turn on HTTPS.
How it fits Domains put your hostname on a Meeting Site. Domains put your hostname on Headquarters.
In Headquarters Settings > Domains
Also called ours, This is us
Your own addresses that are allowed to touch the Meeting Sites, such as scanners and red-team ranges. Their touches still raise alerts and reach your channels, but they are left out of the Post Compromise numbers and get no Pitch while the Pitch scope ignores deconflicted addresses. A Fleet row from one says ours; a Chief adds one there with This is us.
How it fits A Touch from Deconflicted Addresses is kept out of Post Compromise numbers.
In Headquarters Settings > General Workbench > Fleet
The raw evidence every touch leaves. Find it under Workbench > Evidence.
Also called Contact Reports
One address's requests, in order, until it goes quiet for 30 minutes.
Open a Contact Report to see each request and reply.
How it fits A Contact Report is told as a Case File. A Contact Report is grouped into a Controlling Service. A Touch is grouped into a Contact Report. A Time range sets the window of a Contact Report.
In Headquarters Workbench > Evidence > Contact Reports
Every request as it arrives, newest first.
How it fits A Live feed shows each Touch.
In Headquarters Workbench > Evidence > Live feed
Also called AI agents seen
A visitor whose Contact Reports behave like software driven by an AI model, scored from patterns in its requests.
The score is a sum of points for matched signals (high, moderate or low). It is not attribution: it describes behavior, never an identity. In human intelligence terms the AI agent is the agent a Case Officer runs, never the officer.
Kind of Visitor
Kinds Walk-in, Claims to be, What it was after
How it fits A Firewall feed lists the address of an AI agent.
In Headquarters Workbench > Evidence > AI agents
An AI agent that reaches a Meeting Site or Signal Site with no Synthetic Marker leading it there.
It found Ripty on its own.
Kind of AI agent
In Headquarters Workbench > Evidence > AI agents
An AI agent's first arrival at a Meeting Site that a Synthetic Marker led it to.
You staged the meeting; the agent thinks it found the site by chance. The opposite is a Walk-in.
How it fits A Synthetic Marker leads to a Bump.
In Headquarters Workbench > Evidence > AI agents
The name an AI agent gives itself: the known crawler its User-Agent claims to be, else the harness and model on its registration card.
It is the sender's own word, never proof of who it is.
Kind of AI agent
In Headquarters Workbench > Evidence > AI agents
The most severe thing an AI agent asked for, in plain words, such as secret files that hold passwords and API keys.
Headquarters reads it from the paths the agent requested. A dash means it asked for nothing, or it was not read request by request.
Kind of AI agent
In Headquarters Workbench > Evidence > AI agents
Also called Recruited AI agent, Assessed AI agent, Spotted AI agent, Not Spotted
The one-line call Headquarters makes on whether a visitor is an AI agent.
It weighs proof (what the client did with a Pitch) together with the behavior score. The levels climb Not Spotted, Spotted, Assessed, Recruited. Recruited needs confirmed proof.
How it fits An AI verdict judges a Visitor. Tasking can raise an AI verdict to Recruited. A Detection sets the scores for an AI verdict.
Logins and API keys captured from requests, shown masked.
They show what an intruder already holds or is guessing.
How it fits Credentials are captured from a Touch.
In Headquarters Workbench > Evidence > Credentials
A request shaped like a known exploit, such as a Log4Shell probe or a hunt for .env files.
It means the request looked like the exploit, not that anything was compromised.
How it fits An Exploit signature is matched in a Touch.
Also called Last 30 days, Partial
The window of days the evidence pages count, up to 31 days.
"Partial" beside it means the read stopped early on a very busy range, so the counts are lower bounds.
How it fits A Time range sets the window of a Contact Report. A Briefing covers a Time range. Effectiveness covers a Time range. A Presentation covers a Time range.
One step of the story a Case File tells about a visitor, such as reconnaissance, a login probe or a callback.
The steps run from shallow to deep, so the deepest Stage a visitor reached shows how far it got.
How it fits A Stage orders the story of a Case File.
In Headquarters Workbench > Case Files
How many days a Station keeps the evidence it records before it deletes the oldest.
Set it for each Station, or keep everything.
How it fits Evidence retention is how long a Station keeps its evidence.
In Headquarters Workbench > Deception > Stations
How Headquarters groups evidence into stories. Find these under Workbench > Case Files.
One visitor's activity told as a story, stage by stage, with a bottom line and suggested next steps.
Case File pages also offer block rules (block, consider blocking, watch) to copy into a firewall or WAF.
How it fits A Case File is grouped into a Ring. A Case File is mapped onto ATT&CK. A Case File is shared as Exports. A Contact Report is told as a Case File. A Stage orders the story of a Case File. A Severity rates a Case File. An Entity is seen across Case Files.
In Headquarters Workbench > Case Files
How serious an alert or a visit looks: Critical, High, Medium, Low or Info. High on either one means act now.
A Fleet alert rates one source's touches on one sensor of one Station, by the kind of sensor. A Case File rates the source's whole visit, by points for what it did (a decoy used, login probes, a callback), and the header names them. The same touches can read Medium on Fleet and High on the Case File: they rate different things.
How it fits A Severity rates a Case File.
In Headquarters Workbench > Fleet Workbench > Case Files
A group of Case Files whose visitors share infrastructure or behavior.
It says these visitors acted alike, not who is behind them; naming who runs them is the Controlling Service's job.
How it fits A Case File is grouped into a Ring.
In Headquarters Workbench > Case Files > Rings
Also called Controlling Services, Declared Crawler
A named group of Contact Reports that you tie to the one party behind them, made by a Case Officer.
A Case Officer pins Contact Reports into it one by one, or all of a Ring's at once. Ripty also builds one group per known crawler from the organization its User-Agent claims. Those show as Declared Crawlers: the crawler names itself, and that claim is self-reported, not attribution.
How it fits A Contact Report is grouped into a Controlling Service.
In Headquarters Workbench > Case Files > Controlling Services
One thing seen across Case Files: an address, a network range, a domain, a user agent, a technique or a credential.
How it fits An Entity is seen across Case Files.
In Headquarters Workbench > Case Files > Entities
MITRE ATT&CK, the public catalog of adversary tactics and techniques. Headquarters maps what it saw onto it.
How it fits A Case File is mapped onto ATT&CK.
In Headquarters Workbench > Reports > ATT&CK
Also called STIX, TAXII, OCSF
Case Files and Rings sent to your other security tools in standard formats: STIX bundles, a TAXII feed and OCSF events.
A Case File or Ring page has the Export buttons. Viewers cannot export.
How it fits A Case File is shared as Exports.
In Headquarters Any Case File > Export
Ready-made views for leadership. Find them under Workbench > Reports, next to each program's Brief and Weekly report.
Also called Observed, Inferred, Not observed
A print-ready executive report of the time range.
Every claim is tagged Observed (seen directly), Inferred (concluded from what was seen) or Not observed.
How it fits A Briefing covers a Time range.
In Headquarters Workbench > Reports > Briefing
Answers "is it working?": headline numbers and, for each Meeting Site, how far visitors got.
How it fits Effectiveness covers a Time range. Coverage is part of Effectiveness.
In Headquarters Workbench > Reports > Effectiveness
How much of what a visitor could reach or try that the time range's visitors reached: Meeting Site surfaces and ATT&CK techniques.
A low number can mean a quiet week or Meeting Sites that were not running; the Deployment note beside it says which.
How it fits Coverage is part of Effectiveness.
In Headquarters Workbench > Reports > Effectiveness Workbench > Reports > ATT&CK
Also called War room, Present
Big visuals of the time range for a meeting. Present opens the War room, a full-screen wall display.
How it fits A Presentation covers a Time range.
In Headquarters Workbench > Reports > Presentation
Who can do what, and the switches behind the gear.
Every user has one of three roles.
A Viewer reads every page except Credentials and Feed Material, and cannot export. A Case Officer also sees and exports those and can edit Controlling Services. A Chief also runs the Company, Synthetic Markers, Settings, Users and Audit. New users start as Viewers.
Kinds Viewer, Case Officer, Chief
How it fits Audit records changes by Roles. An API key acts under Roles.
In Headquarters Settings > Users
The role that reads every page except Credentials and Feed Material, and cannot export.
New users start as Viewers.
Kind of Roles
In Headquarters Settings > Users
The role that also sees and exports Credentials and Feed Material, and can edit Controlling Services, on top of what a Viewer does.
Kind of Roles
In Headquarters Settings > Users
The role that also runs the Company, Synthetic Markers, Settings, Users and Audit, on top of what a Case Officer does.
Kind of Roles
In Headquarters Settings > Users
The record of who changed what in Headquarters, and when.
How it fits Audit records changes by Roles.
In Headquarters Settings > Audit
Also called Personal API key
A secret you make on your Account page that lets a program, such as Claude Code, use Headquarters as you, without your password.
You name it, choose Full (acts as you, with your role) or Read only, and pick when it expires, or never. Headquarters shows the key once and cannot show it again, so copy it then. A key cannot manage accounts or keys. Revoke it on the same page; a Chief sees everyone's keys under Settings > Users and can revoke them too.
How it fits An API key calls Headquarters. An API key acts under Roles.
In Headquarters Account Settings > Users
Also called Channel, Webhook, Signing secret
Where Headquarters sends alerts and weekly reports, such as your email server.
Each place is a channel: Slack, email, Jira, PagerDuty to page the person on call, or a webhook that feeds your SIEM or SOAR. A webhook is signed with a signing secret, so your receiver can check that Headquarters sent it; Headquarters makes the secret and shows it once. A channel can also be told when a Station has sent no report for 10 minutes, and again when it reports.
How it fits A Weekly report is sent through Notifications.
In Headquarters Settings > Notifications
Also called Detection settings, Behavior score
The scores at which a visitor is listed as an Assessed or a Spotted AI agent, and the points each signal adds.
A Chief can change them, and every list, Case File, alert and report uses the new numbers at once. A result made under changed numbers says so, and the preview says how many addresses the Firewall feed would then hold. Recruited is not among them: it needs proof from a Pitch, no score can produce it, and a visitor that returned proof is listed whatever the numbers say.
How it fits A Detection sets the scores for an AI verdict.
In Headquarters Settings > Detection
Also called Blocklist, Feed policy, Shared network
The list of AI agent addresses that Headquarters says to block, which your firewall pulls from one address.
Ripty never blocks anything itself. The feed policy decides what the list holds: Block rows only, or Consider rows too. A firewall can ask for less than that, never for more. An address on a shared network, such as a CDN or a VPN exit, is never Block, because it can stand for thousands of people. If the saved policy cannot be read, the feed answers with an error instead of a list until a Chief saves it again, so a firewall that keeps its last list keeps blocking, and the notification channels that take fleet alerts are told.
How it fits A Firewall feed lists the address of an AI agent. A Never-list kept out of a Firewall feed.
In Headquarters Workbench > Evidence > AI agents
Addresses and ranges that are never in the Firewall feed, whatever they do, each with a note that says whose they are.
Use it for a partner, a scanner vendor or the address your own traffic leaves from. Without asking, Headquarters never lists private and loopback addresses, its own network addresses, and the address each Station connects from; the Feed policy names them. It cannot see an address behind a NAT or a proxy, so add that one yourself. A row and a Case File say when an address is held back.
How it fits A Never-list kept out of a Firewall feed.
In Headquarters Workbench > Evidence > AI agents
Also called Custom endpoint
The AI model service that writes Feed Material.
A Chief picks one for the whole install: Ripty's own relay, your own vendor key, a custom endpoint (a model service you run, such as a gateway inside your network), or pre-written replies chosen locally, with no model service called.
How it fits An AI provider writes Feed Material.
In Headquarters Settings > AI provider
Also called Evaluation, Trial, Pro, Offline license
The key or file that licenses Headquarters to you; without one it runs as a time-limited evaluation.
Settings > General shows which you have: "Licensed to" your name, or the day of the evaluation. An offline license is a file for a network with no internet.
How it fits A License unlocks Headquarters.
In Headquarters Settings > General
The download that lets a host with no internet install Ripty, carried in beside the release zip.
Use it with an offline license and the offline setting on every host, and choose Local only for the AI provider.
How it fits An Offline bundle installs a Station with no internet.
A switch on your Account page that shows the advanced panels on every page. Shortcut: Shift+A.
How it fits An Advanced Operator shows panels in Headquarters.
In Headquarters Account