Include a #scrape-node-device command that allows a decker to scan through a node which they either are on the ACL of, or has no ICE, for the device that created the node, and if an attempt to intrude upon it has happened, from which device has this occurred. These devices could then be added to the deckers term's data so they can reverse deck.
