Guide
Deploying a network tap without downtime
Choosing between a SPAN port and a passive TAP, what each misses, and how to verify the appliance is genuinely seeing the traffic you think it is.
Resources,
in progress.
We would rather ship a small number of genuinely useful write-ups than pad this page out. Here is what is being written and roughly what each will cover.
Nothing is published yet. The library below is the plan, not the archive. Subscribe at the foot of the page and we will let you know as pieces go live, or ask us directly if there is something specific you need now.
In the pipeline
Technical
Why we analyse on-premise instead of in the cloud
The bandwidth, latency and privacy arithmetic behind running inference on the appliance, including where the cloud approach is genuinely better.
Documentation
Reading a Blueural alert
What each field means, how severity is decided, and which alerts warrant waking someone up versus waiting until morning.
Security
Detecting cryptomining on a network you do not control
Traffic patterns that give away mining activity, and why signature lists stop working almost immediately.
Tutorial
Building an IDS lab on Jetson hardware
A reproducible setup using Suricata and open datasets, aimed at anyone who wants to test our claims rather than take them on faith.
Technical
Baselining a network that changes every week
How behavioural models cope with genuine change — new staff, new devices, seasonal load — without burying you in false positives.
Useful in the meantime
The pages that already answer most of what people ask us.
Get notified when these land
Occasional email when we publish something. No newsletter cadence, no drip sequence.