About Osprey

Discord is open-sourcing Osprey, its internal safety rules engine designed to help platforms detect and respond to harmful activities in real-time. Built in partnership with ROOST and the internet.dev team, Osprey aims to reduce the burden on other companies building trust and safety infrastructure from scratch.

Key Capabilities

Osprey is designed to handle the demands of large-scale platforms:

• Real-time event processing: Handles thousands of events per second with seamless scaling
• Rapid rule deployment: Teams can write expressive rules that take effect in minutes
• Actionable verdicts: Delivers clear decisions on whether user activities are safe, suspicious, or malicious
• Full transparency: Provides detailed logs showing how rules were executed and when errors occur
• Continuous learning: Supports feedback loops where detection insights improve future rules
• Extensibility: Accommodates new detection patterns and future attack vectors

Architecture and Language

The system centers on several core components:

• SML (Some Made-up Language): A Python-based rules language designed for accessibility to non-technical safety teams. Rules reference entities and data with simple, intuitive syntax.
• User Defined Functions (UDFs): Python functions that extend Osprey's capabilities, enabling integration with external services, ML models, and custom detection logic.
• Actions: Events sent to the engine (login attempts, message posts, etc.) as JSON payloads that rules evaluate.
• Entities: Persistent units (users, servers, email addresses) that can be labeled, classified, or flagged based on rule evaluations.
• Effects: Outputs triggered when rules match (applying labels, returning verdicts to callers, logging events).

Results are sent to Apache Druid for downstream investigation and analytics.

Getting Started

The full source code is available on GitHub. Teams can integrate Osprey by ingesting actions via gRPC (synchronous) or message queues (asynchronous), writing custom rules in SML, and extending functionality with Python UDFs.