Malicious event
Legitimate event
Endpoint core
This is the 2D pipeline counterpart to the rotatable 3D concentric-shell version of the same Attack Surface Reduction rule tuner. Each of the four ASR rules gets its own lane with a single checkpoint gate; malicious technique attempts and legitimate business events spawn on the left, travel at constant speed, and are evaluated only at the moment they cross the gate — Off never looks, Audit silently samples and logs, Block samples and actually removes the event. Every sample, whether from Audit or Block, feeds a live Wilson-score 95% confidence interval per rule, so the diagnostics table shows exactly how precisely each rule's true-positive and false-positive rate can be estimated from the traffic observed so far — the same audit-then-enforce workflow security teams use when rolling ASR rules out gradually, made numerically explicit instead of just visually apparent.