Primeagen went over this in the last episode or two - apparently this sort of defense is costing ... one of the big models or companies hosting them ... $900k/day or something to constantly run the best model and monitor 24/7 to combat the attacks [0]

[0] https://www.youtube.com/watch?v=9OahTki4cPA

I don’t really have experience running anything like this so this is very much a comment front the peanut gallery but

Is that really the best way to do things? I’m not really sure what an agent offers here does it just look at logs and do actions? I would not really feel safe if that’s my service’s answer to security.

I could see it maybe as a really smart filter to block ips that are sending probing requests but I don’t really see that as a good reason to have an agent be sitting 24/7 looking at logs.

I think, it's about reviewing code for bugs.