INGESTION / INDEXING / EVIDENCE RETRIEVAL
Atheros Search combines keyword and vector retrieval over configured proxy and wireless observations. RAG builders and operators can inspect source records, embedding jobs, and ingestion state in one workbench.
Trace configured sources, processing, and freshness.
Separate lexical evidence from available semantic coverage.
Review ranked records and explanations. Answer generation is deferred.
This sample illustrates a site-to-indicator-to-observation path. The current production console does not show this complete site overview end to end.
2. Review an indicator for analyst review
North Campus / sample / Sensor 02 / sample
SSID lookalike heuristic / sample
A sample beacon advertises an SSID that resembles a configured network name. The sensor can raise this configured heuristic as an indicator for analyst review. The match alone does not prove a rogue access point.
Observed access point 07 / Beacon observation / sample
Channel 6 / 09:42 UTC / sample time
Sensor 02 recorded a beacon from observed access point 07 on channel 6 at the sample time. This synthetic relationship does not prove an active connection or physical device identity.
Sensor placement, configured channel coverage, observation time, and MAC randomization limit what can be seen. An observed Wi-Fi identifier does not confirm a current connection or physical device identity.
The authenticated workbench includes retrieval, sources, ingestion, and processing. This synthetic sample follows a site, an indicator, and its observations. The current production console does not yet show this complete site overview end to end. Generated answers and new connectors remain future work.
RAG builders and operators who need retrievable evidence, visible processing gaps, and source context for human review.
FOR RAG BUILDERS
FOR OPERATORS AND REVIEWERS
Atheros Sensor uses monitor-mode capture. It listens on configured channels rather than joining access points, then publishes audit records to the configured backend.
Sensor heuristics can flag suspected rogue access points, deauthentication floods, signal anomalies, attack sequences, and PMF-related patterns for analyst review.
Review wireless audit records with site, sensor, channel, and observed-time context. Retention details depend on deployment.
Inventory shows observed Wi-Fi identifiers. MAC randomization and incomplete sensor coverage mean identifiers are not a count of confirmed physical devices.
The ingestion and sources views expose allowlisted processing and coverage measurements. Inspect embedding jobs, worker heartbeats, failures, and timestamps without treating unavailable data as zero.
COVERAGE AND IDENTITY
Sensor placement, configured channel coverage, observation time, and MAC randomization limit what can be seen. An observed Wi-Fi identifier does not confirm a current connection or physical device identity.
The sensor listens on configured channels and publishes audit records to the configured backend. Deployment requires monitor-mode Wi-Fi hardware. Audit fields and retention depend on deployment. No retention duration is promised here.
Worked examples for SQL migrations, wireless investigations, and hybrid search.
Work through synthetic rogue access point observations using SSID, BSSID, channel, time, and authorized-network context. Separate wireless indicators from confirmed incidents.
Use a synthetic time-window example to review Wi-Fi deauthentication and disassociation indicators, capture scope, detector thresholds, and corroborating evidence.
Compare term, vector, and hybrid retrieval on the same synthetic observations. Work through weighted reciprocal-rank fusion and interpret explain data and sparse fallback.