Intrusion Detection / Autonomous Protection

Sudo Mode (Real-Time Reactive IP Shield)

Automated reactive threat defense mechanism exclusive to the Business Plan.

Business Plan Feature Sudo Mode is strictly unlocked for workspaces owned by users on the Business subscription plan. When active, it transforms Sprint Log Parser from a passive telemetry analyzer into an active autonomous defender.

1. How Sudo Mode Works

During real-time ingestion, Sprint Log Parser inspects every incoming log entry (Nginx access logs, error logs, application exceptions, and custom streams) against threat vector signatures.

When Sudo Mode is enabled:

It monitors the attack frequency per IP address across a rolling 60-second window.
If an IP exceeds your configured Attack Trigger Threshold (e.g. 2 concurrent attacks) matching your enabled Threat Category Settings, Sudo Mode triggers an instant auto-block.
The offending IP is automatically added to your workspace's Blocked IP list and propagated to edge enforcement points.

2. Real-Time Edge Enforcement

When Sudo Mode blocks an IP, protection takes effect immediately across all enforcement layers:

Nginx IPS Blocklist

Instantly served via `/api/projects/{token}/blocklist` as `deny <IP>;` directives for web servers.

Linux iptables Chain

Dropped at the OS kernel level via the `MEGASPRINT_BLOCKLIST` iptables firewall chain script.

Cloudflare WAF

Pushed to Cloudflare Zone Access Rules as edge block or challenge actions.

3. Configuration & Thresholds

Navigate to Alert & Notifications (`/notifications`) on your workspace dashboard to configure Sudo Mode:

Setting	Options	Description
Sudo Mode Toggle	Enabled / Disabled	Activates or deactivates autonomous IP blocking.
Attack Threshold	2, 3, 5, 10 attacks / 60s	Number of concurrent attacks in 1 minute before blocking the IP.
Auto-Block Duration	24 Hours, 7 Days, Permanent	Expiration window applied to the auto-generated IP block rule.

4. Whitelist Safeguard

Sudo Mode strictly honors your workspace Whitelist. Whitelisted IP addresses and internal subnet ranges will never be auto-blocked, ensuring safe operation without accidental lockouts of admin infrastructure or authorized monitoring agents.