Practical requirements
- A named owner who authorises integrations
- Rack or virtual capacity in a room you control
- Access to the log sources and, where wanted, a mirror port
- An administrator workstation on your management network
Deployment
Authorise once. Then it works.
A realistic installation, from power-on to verified recovery. Low friction after the owner authorises — never credential theft, never self-installation.
Workflow
Eight steps
- Power-on and local setupThe appliance starts in a closed state with no outbound connectivity. The customer sets administrator credentials on site.
- Discover the permitted environmentThe customer defines the scope: networks, hosts and services the platform may observe. Discovery stays inside that scope.
- Authorise onceThe owner authorises identity and integrations once, through the customer's own management infrastructure or an enrolment agent. No credential is ever taken; nothing installs itself.
- Enrol supported systemsLog sources, agents and mirror ports are enrolled and each proves it is recording.
- Collect local telemetryEvidence accumulates on customer storage, per host, append-only.
- Develop the baselineNormal behaviour of each host and each audience is learned before any response is enabled.
- Enable defensive policyThe customer approves which responses may run, where, and with what approval step. Population effects are measured before activation.
- Verify recoveryRestore of configuration, policy and evidence is rehearsed and its result recorded.
Deployment planner
Produce a planning brief
Answer a few questions and get a recommended deployment class, sensor placement, retention storage and the visibility gaps you would have. It runs entirely in your browser. Nothing is sent; do not enter secrets, address ranges or host names.
Visibility limitations
Without endpoint agents there is no process-level view; without a mirror port there is no east-west view; encrypted payloads stay encrypted. The planner names the gaps your answers leave, and the coverage explorer explains each.
SOVEREIGN BY DESIGN.
Request a technical briefing
Tell us what you need to protect. A briefing is an engineering conversation; it never needs your credentials, network inventories or logs.