PRISM

The core insight is that adversarial infrastructure has a predictable birth cycle — a domain gets registered, gets a TLS cert, gets DNS configured, and only then gets pointed at victims. The window between registration and first use is where you want to catch it, before any SIEM sees a packet. The pipeline works by watching the public signals of that birth cycle in real time