Documentation

#Start here

If you're new, the fastest path from zero to useful threat intel is a single sensor on spare hardware. You'll earn Participant-tier access in 48 hours and pick up the vocabulary — records, Verified Core, Community Mesh — as you go.

• Run a sensor — binary or Docker install, and what data leaves your box.
• Traefik plugin — turn your production edge into a BoarNet sensor, zero request latency.
• Tiers and limits— rate, history, freshness, and what's paywalled.

#Concepts

Two ideas do most of the work in this system: a shared record shape (every public surface renders the same JSON with tier-aware redaction) and a query DSL (search, alerts, and the API all accept the same syntax).

• Query DSL — fields, operators, relative time.
• Alert Triggers — saved queries that flag new matches between visits.

#Reference

• REST API — endpoints, auth, response headers, paywall behavior.
• Sensors — install, enrollment, privacy boundary.