Skip to main content

Hippocampus

Knows what talks to what.

Hippocampus is the platform's map-builder. Every other component reasons about a single connection in front of it; Hippocampus reasons about the relationships — which workloads talk to each other, which are supposed to, and where reality and policy have drifted apart.

It is named for the part of the brain that builds spatial maps, which is exactly its job here.

Observedreal connectionsbetween workloadswhat ISDeclaredthe edges yousay are allowedwhat SHOULD BEControl plane — not in the packet pathWorkload identityresolve an address tothe workload behind itsurvives a rescheduleComparedeclared · undeclared· violationthe disagreement is the findingThe mapworkloads and theedges between themqueryable, out of bandFlat lookups to the agentthis address is that workloadthis edge is declared, or notno graph consulted per packetAmygdalamatches them as ordinaryrule fieldsDashboard and Cerebellumquery the graph itselfObservedDeclaredReasoningTo the agentObservedreal connectionswhat ISDeclaredthe edges you allowwhat SHOULD BEWorkload identityan address resolves tothe workload behind itsurvives a rescheduleComparedeclared · undeclared · violationthe disagreement is the findingFlat lookups to the agentthis address is that workloadthis edge is declared, or notno graph consulted per packetObservedDeclaredReasoningTo the agent
The graph is control-plane. Agents never consult it per packet.

What Hippocampus is for​

  • Turn traffic into a map. Observed connections become a graph of workloads and the edges between them, built from what actually happened rather than from a diagram.
  • Give workloads durable names. A pod IP is meaningless an hour later. Hippocampus resolves traffic back to the workload behind it, so policy can name a service instead of an address.
  • Compare declared against observed. You declare which services may talk; every real connection is classified against that, and the disagreements are the finding.
  • Answer questions about reach. Given the map, what could a workload get to from where it sits?

Where it runs​

Hippocampus is control-plane. It is not in the packet path, and no agent consults a graph per packet.

That split is deliberate and it is what keeps enforcement cheap. The graph is built and queried out of band; what reaches the agent is a flat lookup — this address is that workload, this edge is declared or it is not. Amygdala matches on those as ordinary rule fields, so an east-west rule costs no more to enforce than an address block.

How it fits​

ComponentReasons about
DendriteThis connection — who is on it
ThalamusThis traffic — does it match a signature
CortexThis client — how does it behave
HippocampusThe estate — what talks to what, and what should
AmygdalaThe decision
HillockMaking the kernel act on it

Cross-site correlation — the same workload observed from more than one cluster — is Cerebellum's job rather than the agent's.

Use cases​

  • Find the edges nobody documented — the batch job quietly reaching the production database, the service still calling a dependency that was retired.
  • Microsegment without maintaining IP lists, by declaring that only api may reach payments and letting workload identity keep that true through every reschedule.
  • Scope a compromise by asking what a workload could have reached from where it sat.
  • Turn a policy violation into a block rather than a ticket, once the declarations are trustworthy.

See also​

  • Service Graph — the capability, and how to adopt it
  • Amygdala — matches on the workload identity and edge classification it produces
  • Cortex — behavioural scoring on individual clients