Nodal For MDR
Nodal CyberBrain passively observes east-west activity and correlates related network, identity, and endpoint behaviors into a single investigation. Extend your MDR coverage without replacing the security tools or operational workflows already in place.
Drag across it: the same eleven minutes, as the MDR sees them alone and with Nodal.
The perimeter
Perimeter monitoring inspects traffic entering and leaving the network. Once an attacker finds an exploit and gains a beachhead, they effectively become an insider threat. The firewall is blind to what they do next. Moving from one internal system to another, and on to critical systems, never crosses the firewall. Internal malicious behavior is missed.
The endpoint
An endpoint may log a process execution as “worth looking into” but never raise an alarm, until an incident is identified later. Running a remote execution tool isn’t suspicious on its own; how far it reaches across one or many devices, and what happens next, reveals the intent.
And agents can’t go everywhere. Printers, NAS units, controllers and guest devices can’t run one.
The identity
An attacker drops an AI agent on a system using a valid login. To the endpoint and the perimeter, it looks like an authorized user at work: no exploit, no malware, nothing to flag. Using that identity, the agent can harvest the keys and tokens stored on the system and use them to reach other services and tools, discovering hosts and moving from device to device at machine speed. Every internal move crosses the private network, and that’s where the context lives.
Nodal examines internal network behavior and connects related activity across devices, network segments, and time. It watches the east-west traffic the firewall never sees, covers devices where agents cannot be installed. Nodal follows network connectivity and communication flows every device makes, human or AI operated, across one and multiple hops, and pivoting onto other subnets.
Because Nodal keeps the exact timing of every connection, signals that are overlooked may become a clear sequence: a remote execution tool tied to everything it reached next, a quiet network sweep, a burst of data collection from multiple endpoints, new command-and-control sessions, even when customized to evade known signatures.
This additional context helps security teams understand how an incident is progressing, which systems are involved, and which communications may need to be restricted.
09:41:07.112
Endpoint and network
A remote execution tool, tied to everything it reached next
WS-114 to WS-117, WS-121 and APP-02
+2 min 45 s
09:43:52.604
Network
A quiet network sweep
APP-02 across the server subnet
+7 min 11 s
09:51:03.277
Network and identity
A burst of data collection from multiple endpoints
Four hosts into FILE-02
+1 min 37 s
09:52:40.015
Network
New command-and-control sessions
FILE-02 to 203.0.113.47, payload customized
One investigation
09:41:07 to 09:52:40
Nodal passively analyzes mirrored network traffic between workstations, servers, cloud workloads, infrastructure, and other connected devices, including communications that never cross the network perimeter. Nodal Probes connect to switch mirror ports, network taps or cloud traffic mirroring. Optional Nodal Endpoint Agents can also capture traffic on specific endpoints and join network activity with process-level attribution. Nothing sits inline, and every observation by the Probes and Agents flows to CyberBrain.
More about Network ObservabilityCyberBrain identifies at machine-speed on real-time traffic behaviors such as reconnaissance, service enumeration, suspicious remote sessions, lateral movement, command-and-control activity, and data staging. Machine learning models trained on session behavior recognize C2 frameworks even when payloads are modified to evade signatures, hands-on-keyboard sessions, and AI agents calling tools or communicating with other agents. Nodal correlates these behaviors across time and communications with other systems so analysts can review the broader incident rather than treating each event separately or events that missed the criticality of an alert.
More about Threat DetectionCyberBrain can take in endpoint and identity activity from your existing tools to enrich each investigation. Nodal tickets bring together related detections, device relationships, communication paths, and supporting evidence. Its finding, summary, and evidence can be shared with existing security operations through supported REST APIs, webhooks, SIEM, and ITSM workflows. Automated actions can extend the investigation to the system level through your EDR or XDR when communications span multiple hops, and request threat intelligence on identified external hosts.
More about AI-InvestigatorCyberBrain supports targeted containment through compatible security controls and Nodal Endpoint Agents. Actions are governed by customer-defined policies, asset criticality, evidence strength, and operational risk, helping disrupt malicious communications while allowing unaffected operations to continue.
More about ContainmentThey serve two different purposes, and are often deployed in different places. An MDR sensor sits at the perimeter, your gateway or firewall, and watches north-south traffic for intrusions, using signatures to match known threats. Nodal watches east-west traffic on each switch where it is possible to deploy a probe or on aggregated traffic from a packet broker. Nodal monitors real-time communication between internal devices that may never leave the subnet switch, to understand how each device behaves over time.
One looks for known threats coming in and going out; the other reveals what an attacker or insider does inside the private network before they reach their goal.
MDR sensor
Nodal Probe
Sits at
The perimeter, your gateway or firewall
Each switch, or aggregated traffic from a packet broker
Watches
North-south traffic
East-west traffic between internal devices
Looks for
Known threats, matched by signature
How each device behaves over time
Reveals
Known threats coming in and going out
What an attacker or insider does inside the private network
In a live demonstration, we’ll show how Nodal detects coordinated attack behavior on internal traffic, adds the network context, and supports targeted containment to strengthen your MDR coverage.
Ticket NDL-2291
JSON
{"ticket": "NDL-2291","finding": "Lateral movement to data staging, then C2","summary": "A remote execution tool on WS-114 reached three hosts. A valid login carried an agent from WS-121 to FILE-02, where data from four hosts was collected before a new C2 session opened to 203.0.113.47.","first_seen": "09:41:07.112","last_seen": "09:52:40.015","detections": ["remote execution", "service enumeration", "credential use", "data staging", "C2 session"],"path": ["WS-114", "WS-121", "FILE-02", "203.0.113.47"],"devices": 8,"evidence": ["connection timing", "communication paths", "device relationships"],"next_action": "Restrict FILE-02 to 203.0.113.47"}