Wire inventory
Reads MAC tables from switches and ARP tables from firewalls over SNMPv3, read-only, and places every device on its site, switch, port and VLAN.
appliance capture
Features
Everything the appliance does, in five parts.
16 features, all in today’s build. Seven have screens in the new interface. The other nine work today through alerts, the command line and the appliance’s data routes until their screens arrive. Each page says what it does, what it proves, what it records, and what it does not do yet.
See
Every device on the wire, and an honest account of where you were not looking.
What is on the network, where it is plugged in, and an honest record of when the appliance was and was not reading.
Honest coverage
For every switch and firewall, every day: monitored, partly monitored or not monitored. A gap is shown as a gap, never as "nothing found".
Blind-segment finder
Compares what firewalls and routers know with what the polled switches place on a port, and lists each blind spot with a one-line fix.
appliance segments
Screens designed, not built yet
Decide
Group, preview, sign once. Each device keeps its own signed decision.
People decide about devices, one at a time or in groups, and every decision is signed. Similar decisions shows how comparable devices were decided; it never decides for you, and its screen is in development.
Signed decisions
Approving a device, or marking it not approved, is a decision signed with your name and an authenticator code, and recorded in the audit log.
Bulk sign-off
Group devices, check the exact frozen list, and sign up to 1,000 decisions with one authenticator code. Risky devices are never proposed.
Weekly review
Once a week a Reviewer decides every device that changed and signs the week. The sign-off records coverage, who signed and their roles.
Detect
What devices say about themselves is a claim, not trust.
Devices that pretend to be something else, and links that come and go when nobody is looking. The appliance canary flags something scanning the appliance itself, with its switch port, at Medium.
Impersonation watch
Treats LLDP, CDP, mDNS, SSDP and NetBIOS as claims, and raises a High alert when a device poses as a switch, phone, access point, gateway or another device.
Screens designed, not built yet
Branch tripwires
Catches a link that came up and went down between polls, any link on jacks you arm, and anything connected while a branch is closed, dated by the switch’s own clock.
appliance tripwires
Screens designed, not built yet
Prove
Evidence an examiner checks on their own computer.
A log nobody can quietly rewrite, and evidence an examiner checks on their own computer.
Tamper-evident audit log
Every sign-in, decision and change is an entry in an append-only Merkle log with signed checkpoints, and polling is recorded as hourly roll-ups plus every change in a poll’s result. Editing an old entry breaks every checkpoint after it.
appliance audit
Evidence packs
One signed ZIP for any date range. An examiner verifies it offline, with the verifier or by hand, without trusting the appliance.
appliance verify
Rewind
Ask what was plugged into a port, switch, VLAN or site at any past moment, and whether it was being monitored then, and get a signed answer.
appliance rewind
Screens designed, not built yet
Signed board report
A quarterly report for the board, with the evidence pack inside. The verifier recomputes every number from the signed log.
appliance report-verify
Screens designed, not built yet
Connect
Works with the tools you already run.
Your SIEM, chat, ticketing, directory and EDR lists, and the policy your board approved.
Reconcile against IT’s lists
Compares the wire with Active Directory, Entra ID, Intune, CrowdStrike, Defender and DHCP lists. An import never approves a device.
appliance reconcile
Screens designed, not built yet
Integrations
Sends alerts to Splunk, Microsoft Sentinel, syslog (CEF, LEEF), Teams, Slack, ServiceNow, ConnectWise, Autotask, HaloPSA, PagerDuty, email and your NMS (SNMP informs or traps), filtered per destination, and streams the evidence log to Splunk, Sentinel, syslog and signed webhooks.
Screens designed, not built yet
CSV and NDJSON exports
Seven lists download as formula-safe CSV or NDJSON with the same columns everywhere, and every export from the interface is logged.
appliance export
Screens designed, not built yet
Your policy, measured
Time to detect, time to decision, coverage over time and policy pass or fail, measured from the signed log against the targets your board set.
appliance metrics
Screens designed, not built yet
Launching soon
Not available today.
Two product-level options are launching soon. Neither is available to buy or use yet.
- Launching soon
A hosted console
A hosted console for MSPs and multi-site organizations that manage many appliances. The on-prem appliance stays the core.
- Launching soon
Marketplace
Listings so customers and MSPs can buy and deploy through the marketplaces they already use, with integration listings alongside.
Early access: now taking pilot customers.
See it on your own network.
A live demo with the engineers who built it. We bring a simulated network; you bring your questions.