How it works
How it works
A Sensor listens on one network segment. Optionally, a Manager collects the inventory of many Sensors. Both are single programs with their own database — nothing else to install.
From a packet to an answer
- ListenThe Sensor receives traffic on a host in the segment or on a mirror (SPAN) port.
- DecodeHand-written decoders read discovery protocols and treat every packet as hostile input.
- Collect evidenceFacts are kept per device (MAC address) with their source and age.
- ClassifyReviewed, deterministic rules turn evidence into a type, vendor and model — or leave it unknown.
- AnswerInventory, changes, findings and reports in the web interface, the CLI and exports.
Ways to deploy
In every option the Sensor opens the connection itself. No inbound port is opened in your network, and the Manager has no way to send commands to Sensors.
A single Sensor
An assessment of one site, a pilot, a consultant's laptop. Reports and exports as files.
Sensors and your own Manager
Several sites, everything inside your perimeter. Roles, single sign-on (OpenID Connect) and per-site access.
Manager in your cloud account
No datacenter, sites spread out. Sensors connect outbound only; the data stays in your account.
Isolated networks
Industrial control, labs and segments without a path out. An export file is carried to the Manager.
Planned: a Manager operated for you by a managed service provider, with each customer in a fully separate tenant (its own database, certificate authority and users).
What it needs
| Component | Runs on | Notes |
|---|---|---|
| Sensor | Linux (Debian package, amd64 and arm64); macOS for evaluation | A host in the segment or a mirror port. Runs as a dedicated user with only the packet-capture capabilities. |
| Manager | Linux server or VM | One program with a built-in database and its own certificate authority. No external database or message broker. |
| Mobile app | Android | Read-only view of the Manager, paired with its own certificate. |