Operations

Honeypot behaviors are powered by a set of composable operations. Each operation defines how raw events are aggregated into a behavioral signal over a time window.

Count

Counts events matching criteria within a time window.

Rate limiting, activity monitoring

Unique

Tracks unique values for specified fields with occurrence counts.

Multi-account detection, unique visitors

Distance

Calculates geographic distance between consecutive events.

Impossible travel detection

Proximity

Tracks deviation from a user's "normal" location over time.

Location anomaly, fraud detection

Ratio

Calculates the proportion between two event types (0 to 1).

Skip rate, failure rate, credential stuffing

Sequence

Detects ordered event sequences with completion tracking and timing.

Funnel analysis, user journeys

Time Between

Measures time intervals between consecutive matching events.

Bot detection, session analysis

Timeline

Builds a chronological event log with summary stats covering the full window.

Audit trails, abuse investigation

Top N

Tracks top N values ranked by engagement count or numeric sum with per-event breakdowns.

Personalization, recommendations

Sum

Accumulates a numeric field with optional per-partition breakdowns and stats.

Total play time, cumulative spend