Tactics

• Detect (Suricata minimal rulesets, targeted sensors)
• Deceive (OpenCanary service bouquet: SSH/HTTP/PGSQL as lures)
• Delay (nftables/iptables, tc shaping: windowed thresholds, unlock timers)
• Notify (local UI, e-paper, chat hooks; actionable summaries)