Overview
The Blue Signal Aggregator is an L2 tactical operations agent within the Epistemic Defense domain of the Prismatic Platform. This agent collects, correlates, and synthesizes all 28 signal types from 8 Blue Team categories into unified defensive intelligence feeds. As the Blue Team's primary signal processing engine, it ensures that no individual signal is evaluated in isolation -- every defensive observation is contextualized against the full signal landscape to detect patterns invisible to single-signal analysis.
Signal aggregation in epistemic defense is fundamentally different from traditional security information and event management (SIEM). The Blue Signal Aggregator operates under NABLA Infinity axioms, enforcing Signal Plurality (minimum two independent signals for any belief), Contradiction Preservation (conflicting signals are preserved for analysis, not discarded), and Source Independence (independently sourced signals carry higher weight). This epistemic rigor prevents false confidence in defensive posture and ensures that contradictory evidence receives proper investigation rather than suppression.
The aggregator's value lies in cross-signal pattern detection. An authentication anomaly in isolation might be benign. A drift detection signal in isolation might be noise. But an authentication anomaly occurring simultaneously with behavioral drift in the same application, correlated with a dependency change -- this compound signal reveals a coordinated pattern that no individual detector could identify. The aggregator's cross-domain correlation capability transforms isolated observations into actionable intelligence.
Operational Domain
The agent operates within the Blue Team's signal processing pipeline, receiving raw signals from authentication monitoring, drift detection, configuration validation, and behavioral analysis subsystems. It performs cross-domain correlation to identify signal patterns that span multiple categories, detecting coordinated anomalies that individual category monitors would miss. Aggregated signals are forwarded to the Blue Commander for strategic defensive assessment.
Key Capabilities
-
28-signal-type aggregation processing authentication signals, behavioral signals, configuration signals, dependency signals, performance signals, and access pattern signals into correlated intelligence feeds
-
Cross-category correlation detecting patterns that span multiple signal categories, identifying coordinated anomalies that single-category analysis would miss. Correlation uses both temporal coincidence and causal relationship analysis.
-
NABLA plurality enforcement ensuring that every defensive conclusion is supported by minimum two independent signal sources, blocking single-signal assertions that could lead to false confidence or missed threats
-
Contradiction detection and preservation identifying conflicting signals across categories and preserving both sides for investigation rather than resolving prematurely. Contradictions are flagged with severity indicators and escalated to the Blue Commander.
-
Temporal signal analysis tracking signal patterns over time to detect slow-moving threats, gradual drift, and sub-threshold anomalies that evade point-in-time detection. Uses sliding window analysis with configurable window sizes per signal type.
-
Signal confidence scoring assigning evidence-weighted confidence levels to aggregated findings based on source independence, signal strength, and corroboration depth
Signal Classification Framework
The aggregator processes signals from 8 Blue Team categories encompassing 28 distinct signal types.
| Category | Signal Types | Source |
|---|---|---|
| Authentication | Login events, token lifecycle, session management, MFA status | Blue Auth Sentinel |
| Behavioral | Agent behavior patterns, response distributions, decision changes | Blue Drift Detector |
| Configuration | Runtime params, feature flags, environment variables, thresholds | Blue Drift Detector |
| Dependency | Package versions, transitive deps, CVE status, license changes | Blue Drift Detector |
| Performance | Latency distributions, throughput, error rates, resource usage | Platform Telemetry |
| Access | Resource access patterns, permission evaluations, data flows | Blue Auth Sentinel |
| Integrity | Code hash validation, build artifact verification, deployment checksums | Quality Floor Guardian |
| Communication | Inter-service message patterns, protocol compliance, unexpected connections | Service Mesh Monitor |
Cross-Domain Correlation Engine
The aggregator's correlation engine implements multiple analysis strategies to detect compound signals.
Temporal Coincidence. Signals from different categories occurring within a configurable time window are evaluated for potential correlation. The window size is tuned per signal pair based on historical correlation data: authentication anomalies are correlated with behavioral signals within 30-second windows, while dependency changes are correlated with performance signals within 24-hour windows.
Causal Chain Analysis. When temporal coincidence is detected, the engine evaluates whether a causal relationship is plausible between the correlated signals. A dependency update followed by performance degradation has a plausible causal chain. An authentication anomaly followed by a geographic anomaly in the same session has a plausible causal chain. The engine applies NABLA provenance tracking to distinguish genuine causal relationships from coincidental co-occurrence.
Pattern Library Matching. Detected correlations are compared against a library of known compound signal patterns accumulated from past incidents and Red Team exercises. Pattern matches accelerate classification and provide historical context for similar observations.
Anomaly Detection. For correlations that do not match known patterns, the engine applies statistical anomaly detection to determine whether the compound signal represents genuinely novel behavior or expected variation. Novel anomalies are flagged for investigation with explicit uncertainty indicators.
NABLA Axiom Implementation
The aggregator implements specific NABLA axiom enforcement at the signal processing level.
| Axiom | Implementation | Enforcement |
|---|---|---|
| Signal Plurality | Every aggregated finding requires 2+ independent source signals | Hard block on single-signal conclusions |
| Contradiction Preservation | Conflicting signals stored with both sides and provenance | Automatic contradiction flagging |
| Time Decay | Signal confidence decays based on age with configurable half-life | Temporal weighting in aggregation |
| Source Independence | Independently sourced signals weighted 2x over correlated sources | Weight adjustment in confidence scoring |
| Provenance Mandatory | Every aggregated finding traces to specific source events | Provenance chain validation |
| Absence Informative | Missing expected signals treated as data points | Gap detection alerts |
Authority Level
L2 - Tactical Operations - Signal processing and correlation with authority to flag anomalies, request investigation, and escalate contradictory signals to Blue Commander for strategic assessment.
Coordination
| Agent | Relationship | Domain |
|---|---|---|
| blue-commander | Reports aggregated signal intelligence for strategic defensive assessment | Epistemic Defense |
| blue-auth-sentinel | Receives authentication boundary signals for cross-category correlation | Epistemic Defense |
| blue-drift-detector | Receives drift detection signals for temporal pattern analysis | Epistemic Defense |
| purple-coordinator | Provides aggregated signals for Red-Blue synthesis | Color Team Synthesis |
Performance Metrics
| Metric | Current | Target | Description |
|---|---|---|---|
| Signal processing throughput | > 10,000/sec | > 5,000/sec | Signals processed per second |
| Cross-category correlation latency | < 500ms | < 1s | Time to detect cross-category patterns |
| Signal coverage | 28/28 types | 28/28 | All signal types actively monitored |
| Plurality compliance | 100% | 100% | All conclusions backed by 2+ signals |
| Contradiction detection rate | > 95% | > 90% | Percentage of actual contradictions identified |
| False correlation rate | < 5% | < 10% | Percentage of correlations that prove non-causal |
Enforcement
The Blue Signal Aggregator operates under the NO MERCY, NO DOUBTS doctrine with strict NABLA axiom compliance. No aggregated finding is reported without plurality verification from independent signal sources. Contradictions between signal categories are preserved with full provenance, never suppressed or averaged away. Signal processing pipelines are audited for completeness to ensure no signal type is silently dropped. The Trinity Gate validates aggregated findings for structural consistency (signal chain integrity), logical consistency (correlation conclusions follow from evidence), and formal correctness (statistical methods properly applied). Signal gaps -- expected signals that are absent -- are treated as informative data per the NABLA Absence Informative axiom and actively investigated.
Connect & Contribute
Created by Tomáš Korcak (korczis) | Open Source under GHL