Apollo

The watch

Apollo is the defensive layer. It watches who is probing the platform, correlates what the different layers see, blocks what has earned it, and tells a human when something matters. It is defensive only: it records, refuses and reports, and never reaches back out at anybody.

What it gives you

One picture instead of several. Network level noise, connection level behaviour and application level attempts are correlated into a single view per actor, so a slow campaign spread thinly across all three stops looking like three unrelated trickles.

Graduated responses. Not everything deserves the same answer. Something merely odd can be challenged, something persistent can be slowed down, and something unambiguous can be refused outright for a while. Responses expire on their own, so a bad afternoon does not become a permanent block list nobody maintains.

Blocking that is written down. Countries, providers and address ranges can be refused before anything on the host answers them, each rule carrying the reason it exists and the scope it applies to, and each one switchable without being deleted. Rules are applied deliberately, in one operation, rather than silently drifting into effect.

An allowlist that outranks everything. Addresses you depend on, the office, a monitoring probe, a partner integration, can never be caught by automatic defence.

Known bad lists, imported on your terms. Public threat feeds are pulled in as named drop sets, so you can see which list contributed what and remove one wholesale if it turns out to be noisy.

Lookup before the fact. Any address can be asked about directly: where it is registered, which provider routes it, whether it is known as a proxy or a hosting exit. You do not have to wait for it to do something first.

Alerts that reach a person. Everything Apollo raises is filed with the platform's notification service and tracked until somebody has actually seen it. Which alerts reach you and which stay in the panel is a setting, and turning one off changes what you are told, never what Apollo records.

Who it is for

Anyone whose infrastructure is reachable from the internet, which is to say anyone. It replaces a drawer of half configured tools with one place that can answer what is currently being refused and why.