FRIEND events are the citation signal. When ChatGPT-User appears in the log, a real user's query triggered retrieval from the site. When ClaudeBot appears for the third time in a session covering multiple pages, Anthropic's system is conducting a deep content evaluation. When Applebot hits geo-specific service pages, Apple Intelligence is building geographic coverage.
The frequency pattern of FRIEND events is more informative than individual events. ChatGPT-User appearing once is a data point. ChatGPT-User appearing every day for 68 consecutive days is evidence of sustained citation authority. ClaudeBot sweeping 130 pages in a single session is evidence of a deep evaluation cycle.
FOE events reveal which adversary classes are monitoring the site. Zayo IP ranges hitting position-1 pages within minutes of GSC position changes means real-time rank tracking infrastructure is watching. AWS-masked sweeps across multiple pages in rapid sequence means commercial intelligence platforms are conducting forensic analysis.
FOE event frequency and timing often correlates with ranking events. A position improvement in GSC frequently triggers a Zayo sweep within hours — the rank tracking infrastructure updates its position data in near real-time. This makes Zayo sweeps a free rank verification signal: when Zayo hits a page, that page is ranking.
BOMB events indicate malicious probe activity: WordPress exploit scanners, SQL injection attempts, PHP shell upload probes. The slow-drip response wastes attacker resources without providing exploitable data.
BOMB event patterns reveal whether the site is under targeted attack or routine automated scanning. A single BOMB event from a Vietnamese IP probing for wp-login.php is routine automated scanning. Multiple coordinated BOMB events from different IPs targeting the same probe path in a short window suggests a targeted operation.
UNKNOWN events are the most analytically interesting. These are requests from actors not yet classified — no match in the FRIEND or FOE rules. UNKNOWN events from residential IPs using real browser user agents may be human competitors manually researching the site. UNKNOWN events from cloud infrastructure IPs may be new adversary actors not yet in the classification database.
Building classification rules from UNKNOWN event patterns is how the gate becomes more intelligent over time. An UNKNOWN actor that appears multiple times with consistent behavior gets classified as a FOE and added to the configuration. The gate improves continuously through operational learning.