Reconcile against IT’s lists
Compares the wire with Active Directory, Entra ID, Intune, CrowdStrike, Defender and DHCP lists. An import never approves a device.
Connect · Integrations
Alerts and evidence where your team already looks.
Sends alerts to Splunk, Microsoft Sentinel, syslog, Teams, Slack, ServiceNow, ConnectWise, Autotask, HaloPSA, PagerDuty, email and your network monitoring system, and streams the evidence log to Splunk, Sentinel, syslog and signed webhooks.
The problem
An alert nobody sees is not a control. A bank or an MSP already watches a SIEM, a chat channel, a ticket queue, a pager and a network monitoring system.
And an alert stream nobody can tune gets muted. Each destination needs to receive only what its team acts on.
How it works, illustrated
What this shows
The GigID Labs Appliance sits in the middle. Arrows go out from it, only to systems an Admin configures: SIEM and logs (Splunk, Microsoft Sentinel, Syslog); Chat (Microsoft Teams, Slack); Email, paging, SNMP and webhooks (Email, PagerDuty, SNMP, Webhook); Ticketing and PSA (ServiceNow, ConnectWise, Autotask, HaloPSA); Exports (CSV, NDJSON). One dashed arrow comes in: device lists to reconcile (Active Directory, Microsoft Entra ID, Microsoft Intune, CrowdStrike, Microsoft Defender, DHCP, Spreadsheet), imported as files or pulled from your own Microsoft tenant; an import never approves a device. GigID Labs is refused as a destination: there is no connection to it.
An Admin adds destinations with an authenticator code, through the settings API today. The setup screen, “Where alerts and evidence go”, is in development with the new interface.
Each destination can be filtered: only, or never, alerts about a vendor, subnet, site, switch, port, VLAN or evidence tier. Clone, impersonation, tripwire and not-approved alerts are never held back by a vendor rule, because a device chooses its own MAC address.
Examiners can see every destination and its delivery log, read-only.
How it works
- Each new alert is queued in the same transaction that raised it, so an alert is never lost between the database and the destination.
- A slow or unreachable destination never delays the others. Retries back off from 30 seconds to an hour, for up to 72 hours.
- The audit stream sends every log entry in order. A SIEM that was down for a week receives what it missed.
- One ticket per device per destination, ever. A retry looks for its own marker before opening a ticket.
- PagerDuty gets a trigger when an alert is raised and a resolve when it resolves, with one deduplication key per alert, through the Events API v2.
- SNMP notifications go to your NMS as SNMPv3 informs by default, which the NMS acknowledges, so a lost one is retried rather than silent; traps are an option. The appliance ships the MIB to load. Polling your switches stays read-only: sending a notification to your NMS is not a write to your gear.
- Every address is checked when you save it and again before every connection. Loopback, link-local, cloud metadata and reserved addresses are always refused; private ranges need an explicit opt-in. Redirects are never followed.
- Secrets are sealed and write-only, and scrubbed from every payload and error message.
What it proves
Every delivery result and every change to where data goes is an audit entry, so “did the alert reach someone?” has a provable answer. Streaming the log off the box also keeps checkpoint copies the verifier can use.
What it records
Entries this feature writes to the tamper-evident audit log. Each one is in the evidence packs that cover its date.
- alert_deliveredThe final delivery result for each alert and destination.
- config_changeEvery non-secret setting of a destination, so any change to where data goes changes the entry.
- stream_skippedAn entry a receiver refused, set aside so the stream continues.
- self_testEach Send test.
Limits
What it does not do yet, stated plainly. The technical page lists every known gap.
- Request formats were tested against local stand-ins, not vendor sandboxes. SNMP notifications were also checked against net-snmp’s receiver; PagerDuty has not yet been run against a real account.
- The MIB uses a placeholder enterprise number until GigID Labs has its own, so its OIDs will move once.
- There is no outbound proxy support yet.
- Alert messages do not link back to the appliance yet.
- The setup screen is in development. Destinations and their filters are added through the settings API today.
Technical detail
Early access: now taking pilot customers.
See it on your own network.
A live demo with the engineers who built it. We bring a simulated network; you bring your questions.