orioneye.io | OrionEye — Development Update (October 4–9, 2026) Over the past week we shipped more than 60 changes to OrionEye, our real-time cyber threat intelligence platform. The focus was turning detection into action: finding attackers faster, responding in one click, and keeping a reliable record of every decision.
Attackers panel, rebuilt Attack timestamps. Each attacker now shows the first and last attack time, read directly from the server's SSH logs. Search and filters. Full-text search across IP, country, network (ASN), targeted server and usernames tried, plus filters by status, country and server and three sort orders. Block, unblock, report. One-click actions with explicit operator confirmation. Blocks run through OmniAgent on the operator's own servers, or through fail2ban on the OrionEye host. Persistent status. Every block, unblock and AbuseIPDB report is stored in the database. Each attacker is clearly marked as Blocked, Free after block or Never blocked. The panel reconciles itself with the live fail2ban jail, so expired bans are detected automatically. Map focus. Selecting an attacker centres the map on a pulsing red marker with a 100 km radius and opens a proximity OSINT briefing (local news, Wikipedia, public cameras, reputation) on the right.
Auto Detect A new toggle turns the panel into a continuous monitor:
At an interval you choose (30 s to 5 min), OrionEye reads the SSH logs of every server linked to OmniAgent and compares them with its history. New attackers, and known ones that resume attacking, appear on the globe as pulsing markers with a 100 km area. Clicking a marker opens a detail card with Report, Block/Unblock and Proximity actions. Every action updates the database in real time. AI Console: new agents The conversational console can now act on the platform directly:
clear the map, block, unblock or report a single IP, open the topology view and run actions inside it, compute Green Active Defence figures. Every action that touches a server requires explicit human approval: the model proposes, the operator decides. Voice synthesis can now be switched on or off from the settings, stops when its panel closes, and no longer reads Markdown symbols aloud.
Green Active Defence A new engine in OmniAgent estimates the compute and energy wasted on malicious traffic, and the share avoided by blocking it. Figures are derived from real nftables counters rather than assumptions. The results are available in a dedicated OrionEye panel and on a new landing page with a narrated video in Italian and English.
3D globe performance Map points are now rendered on WebGL by default, which keeps the globe smooth with thousands of entities across all layers. Points scale with distance, the camera no longer jitters during gestures, and satellite data is cached on disk to respect upstream rate limits. The AREA tools (rectangle, circle, polygon) work on the globe again, and clicking any element opens its proximity briefing. A new search bar sits next to the drawing tools, and a single "clear all" button resets both the map and the globe.
Integrations MCP connector. An OAuth gateway for Pro and Enterprise plans, with long-lived sessions and a service credential, tested end to end with an external AI client. OmniAgent OS. Mitigations are linked to OmniAgent, there is a new Automation menu, and the OmniVault specification covers vault custody, M-of-N recovery and air-gapped revocation. Internationalisation The interface, the AI console, the map commands and all new panels are fully available in Italian and English. Switching language takes effect instantly, with no page reload.
Reliability AI briefings no longer stop after a few words: reasoning models now have their own token budget. The console reports the outcome of an action even when the model returns no text. Attacker locations are no longer erased by incomplete scans, and missing coordinates are recovered in the background. Sessions on the USB key, the phone and the desktop browser no longer log each other out. A deployment fix guarantees that on-demand modules always find their stylesheet. Web presence orioneye.io now has a complete sitemap, proper hreflang tags and structured product data, all validated in Google Search Console. We also added a Data Sovereignty page, two documented real-world cases (an SSH brute-force campaign and a SIP attack on a business PBX), and a product documentation suite in three tiers and three languages.
Next up: real-world validation of Auto Detect across multi-server deployments, and verified customer reviews for our product listing.
Log in or sign up for Devpost to join the conversation.