cernity

Automated response playbooks on final findings

YARA scanning of carved files for novel malware

Flink SQL streaming detectors (scan detection + session stitching)

Hash-based detection on carved files

Session reconstruction and asset timelines

Promote Zeek notices into findings

Central, on-demand Zeek enrichment of captured PCAPs

Gate and orchestrate on-demand packet capture

Cross-signal finding correlation

Sensor-side on-demand PCAP capture agent

Asset inventory and internal / external classification

Finding lifecycle: dedup, MITRE ATT&CK tagging, and routing

Normalize Suricata EVE telemetry into ClickHouse for retention and hunting

Deliver final findings to your SIEM via pluggable sink adapters

Threat-intel matching against abuse.ch feeds

Statistical anomaly detection over network telemetry

Lateral-movement detection (SMB, RDP, DCE-RPC, Kerberos)

Sensor mirror-completeness / coverage signal

TLS / certificate / SSH protocol-anomaly detection

RITA-style behavioral detection (beaconing, exfil, DNS tunneling) over Suricata flow telemetry

DNS-based detection: NXDOMAIN patterns and tunneling

HTTP anomaly detection over Suricata HTTP telemetry

Promote Suricata signature alerts into the Cernity finding pipeline