Nodal CyberBrain
Dominate your network. Dominate your security.
Nodal CyberBrain is a real-time security engine for defending your network in depth, designed to continuously observe, understand and act on activity immediately after perimeter security is breached, a compromised device joins the network, or an insider threat emerges.
Fast Case 9f31c204-6ab8-4d17-9e55-2c81f7ad4e60
- 02:14:07DLL staged under a thumbnail-cache namerundll32.exe → thumbcache_96.db · parent wmiprvse.exe
- 02:14:08WMI spawns a system binary with no logon sessionwmiprvse.exe → rundll32.exe · no interactive user
- 02:14:09Encoded PowerShell opens WinRM to a new peer10.0.4.17 → 10.0.4.62:5985 · SYSTEM
- 02:14:31Port-forward established on relayssh -N -L 0.0.0.0:9443 → 10.0.9.8 · root
- 02:14:33Unmanaged appliance enters the path10.0.9.8 · no endpoint agent available
- 02:31:16Credential material read from LSASShandle opened by a system process · no dump written to disk
- 02:47:52Outbound POST to external hostcurl -k → 198.51.100.74:8443 · TLS verification disabled
- 03:31:04Sustained transfer settles into a steady rate640MB over tcp/9443 · 18 sessions · no jitter
- 05:12:47Failover peer contacted in the same /24198.51.100.203:8443 · after the primary went quiet
- 06:26:41Chain reconstructed · 4 hopsconfidence 0.912 · 1.9 GB relayed
- 06:26:42Firewall mitigation issuedShort-lived block on 198.51.100.74:8443
Nodal Confidence at 91%
Agent Confidence at 68%
Four device tickets are open. The first traces a four-hop path out of the network — built entirely from the systems' own Windows and Linux tools.
1/8Nodal brings deep network observability, real‑time behavioral detection, attack path mapping, automated mitigation and containment, and AI investigation into a single platform.
We work at the network layer. Attackers cannot avoid it.
An intruder can disable an endpoint agent, borrow a valid credential or wait out a scan. They still have to cross the network to reach anything else. That traffic is where Nodal watches, and it is the one view of an attack that cannot be switched off from the inside.
- Out of band
- Nothing sits inline. Nothing can be uninstalled from the host.
- Every device
- Managed or not: printers, controllers, appliances, cameras.
- Every hop
- East-west between systems, and north-south out to the internet.
One engine, from packet to response.
Telemetry is collected at the network, enriched by the tools you already run, reasoned over in real time, and handed to your team with the first action already taken.
Data ingestion
- Nodal ProbesNetwork telemetry
- Nodal AgentsEndpoint, network and process telemetry; security control
- Network preprocessingPackets and events into time-series telemetry with rich metadata
Integrations
- EndpointCrowdStrike
- IdentityOkta
- Security controlsCisco, Palo Alto, Guardicore
CyberBrain engine
- Real-time behavioral detection
- Signal correlation
- Attack path mapping
- Automation
Security operations
- Nodal admin hub and UI
- Automated AI investigation
- Evidence collection
- Security control automation
- Incident and ticket management
Architecture
Four stages, running continuously.
There is no queue between these stages and no analyst gating them. Disruption can happen while investigation is still in progress.
- 01Sensor
Passive network observation
Traffic is observed out of band. Nothing is placed inline, no agent is installed, and no device is asked to change how it behaves. Every observation is recorded with its precise timing.
Deployment & Stack Fit - 02Fabric
Behavioural correlation
Network evidence and streamed endpoint telemetry accumulate in a shared correlation layer, where fragmented low-confidence signals are matched against communication behaviour rather than signatures.
- 03Investigation
Agentic campaign reasoning
Once evidence crosses threshold, an investigation agent reasons over everything collected — behavioural, profiling and reputational analysis — and reaches an explainable verdict.
AI-driven Investigation - 04Response
Disruption and containment
A short-lived firewall mitigation interrupts the channel immediately; policy decides whether endpoint containment follows automatically or waits for an analyst.
Automated Response & Containment
10.0.4.17
Workstation · SYSTEM
rundll32 → powershell
10.0.4.62
Internal peer · root
ssh -N -L 0.0.0.0:9443
10.0.9.8
Subnet bridge · unmanaged
no endpoint agent possible
198.51.100.74
External host
C2 · tcp/8443
Investigation verdict
Built-in Windows and Linux tools relay 10.0.4.17 → 10.0.4.62 → 10.0.9.8 out to an external host on tcp/8443. No malware anywhere in the path, and the hop carrying the volume runs no agent.
Defense‑in‑depth security.
When prevention fails, detect, investigate and disrupt active threats before they spread.
- Detect
Find suspicious activity early
- Understand
Map device relationships and C2 chains
- Disrupt
Block malicious communications
- Verify
Confirm the threat is contained
Protects against
- Initial compromise
- Command and control
- Lateral movement
- Internal reconnaissance
- Persistence and re-entry
- Insider and trusted-access abuse
- Defense evasion
- Active breach propagation
Every capability, one platform.
Network Observability
Every device, service and relationship, as the network actually behaves.
Real-time Threat Detection
Detect the behaviour, trace it to its origin, and cut the attacker's channel automatically.
AI-driven Investigation
Machine learning at every stage turns network activity into one ticket; the AI Investigator explains what happened and what to do next.
Deployment options
Probes on a mirror port, cloud traffic mirroring, or an agent where a device needs attribution.
Partners
Technology, channel and research partners, and how to become one.
See it on your traffic
Watch CyberBrain reconstruct a live attack chain.
A 30-minute technical walkthrough on sanitised threat data — or a proof of concept in your own environment. No agents required to evaluate.