From f2de050587efc8a182a7423282f6dae7b3bf3d19 Mon Sep 17 00:00:00 2001
From: hrbrmstr <bob@rud.is>
Date: Sun, 17 May 2026 08:18:36 -0400
Subject: add: gribouille

---
 2026/2026-05-17-gribouille/drop.typ | 48 +++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 2026/2026-05-17-gribouille/drop.typ

(limited to '2026/2026-05-17-gribouille/drop.typ')

diff --git a/2026/2026-05-17-gribouille/drop.typ b/2026/2026-05-17-gribouille/drop.typ
new file mode 100644
index 0000000..b830494
--- /dev/null
+++ b/2026/2026-05-17-gribouille/drop.typ
@@ -0,0 +1,48 @@
+#import "./gribouille/lib.typ":*
+
+#set text(font: "Goldman Sans")
+
+#let results = csv("src_ip_last1h.csv", row-type: dictionary)
+
+#let p = plot(
+    data: results,
+    mapping: aes(
+      x: "total_sessions",
+      y: "unique_dst_ports",
+      size: "unique_sensors",
+    ),
+    layers: (
+      geom-point(alpha: 0.65),
+      annotate(
+        "text",
+        x: 23424,
+        y: 3,
+        label: typst(align(right)[`93.123.72.166` dominates with\ ~77% of non-spoofable traffic.]),
+        anchor: "south-east",
+        dx: 0.0,
+        dy: 0.3,
+        size: 7pt,
+      ),
+    ),
+    scales: (
+      scale-x-log10(labels: format-comma()),
+      scale-y-log10(),
+      scale-size-area(),
+    ),
+    labs: labs(
+      title: typst([#h(1.5cm)Sensor Fleet Activity (1 Hour)]),
+      subtitle: typst(pad(left: 1.5cm)[943 source IPs across 30,460 sessions in the last hour.]),
+      x: "Total Sessions (log₁₀)",
+      y: "Unique Destination Ports",
+      size: "# Unique Sensors",
+    ),
+    theme: theme-minimal(
+      text: element-text(),
+      plot-title: element-text(size: 14pt, weight: "bold"),
+      plot-subtitle: element-text(margin: margin(left:3in)),
+    ),
+    width: 14cm,
+    height: 9cm,
+  )
+
+  #p
-- 
cgit v1.2.3