Active Defense, Empowering Defenders
Nythrix transforms active defense from isolated tooling into a governed, measurable program that reduces lifecycle time and total incident cost.
The Framework
Active defense only works when it is governed, repeatable, and measurable. The platform is structured around four operating principles.
Governed Active Defense
Pre-authorized containment with guardrails, approvals, and tiered authorization gates. Move fast without creating operational or governance risk.
High-Confidence Signals
Deterministic triggers across deception, validation, and hunting — explainable, low-noise, and ready for an analyst to act on.
Faster Detection-to-Recovery
Shorten the time from detection to containment to recovery. Repeatable response that reduces dwell time and limits scope expansion.
Outcome-Based Reporting
Measure what matters: detection time, containment time, recovery time, and blast radius. Not alert volume.
Faster Detection-to-Recovery
| Stage | Traditional Programs | Nythrix Model |
|---|---|---|
| Detect | High noise, delayed confidence | Deterministic, explainable signals |
| Contain | Reactive decisions | Pre-authorized governed actions |
| Recover | Broad scope, longer downtime | Constrained blast radius |
| Report | Alert volume metrics | Outcome-based board metrics |
Under the Hood
The platform is a fully automated detection and response pipeline — not a collection of disconnected tools. Here's what runs when a deception asset is triggered.
Closed-Loop SIEM Verification
Detection rules pushed to your SIEM are re-verified daily — the platform calls back to confirm each rule still exists, is enabled, and is firing, then records a fire-count from your signals index. Silent rule removal is caught automatically, not at audit time.
Consequence-Based Scoring
Every incident is scored on real-world business impact — Safety, Regulatory, Financial, Operational, and Reputational — not technical severity alone. The Consequence Risk Model (CRM v1.0) weights impact (35%), likelihood (30%), exposure (20%), and confidence (15%).
Governed Containment
Pre-authorized response tiers with documented rollback windows, cross-functional approval gates, and full audit trails. Active defense executes fast — without uncontrolled blast radius or undefined accountability.
Zero Admin Contamination
Collectors are adversary-facing by design. Admin traffic, security scans, and operator activity never land in detection data — which means every interaction with a decoy is a confirmed intrusion signal, not a colleague running a sweep.
8-Stage Detection Pipeline
Detections flow through MITRE classification (2s), incident deduplication (5s), consequence-based risk scoring (30s), adversary session profiling (30s), coverage scoring, deployment orchestration, asset inventory sync, and threat intel correlation — fully automated.
Adversary Intelligence
Automatic session building by source IP with TTPs, dwell time analysis, kill chain coverage, and containment recommendations. Full STIX 2.1 export. Campaign tracking with Diamond Model analysis across 62 known APT groups.
Realism Engine
Environment-consistent naming templates, OS fingerprint profiles (Windows, Linux, network devices), realistic service banners, and breadcrumb campaigns that guide adversaries toward instrumented assets.
SSH Session Recording
Full-interaction SSH honeypot captures every command, download, and tunnel in the attacker session. HTML5 terminal replay, SSH client fingerprinting, and automated adversary tool detection (Mimikatz, psexec, etc.).
Deception Asset Library
Decoys span SSH, RDP, SMB, web admin panels, databases (MSSQL, MySQL), AD service accounts, and protocol-level honeypots — each rendered with realistic hostnames, banners, and fingerprints from per-environment naming templates so adversaries engage instead of skipping past.
Auto-Correlated Threat Intel
Every IOC observed at a decoy is auto-correlated against active incidents and historical data — across commercial and community sources (AbuseIPDB, GreyNoise, Shodan, VirusTotal, ThreatFox, URLhaus). Custom feed management (OTX, MISP, CSV) supports your in-house intelligence too.
SOAR & Playbook Engine
Trigger-based automation on 6 event types with condition logic, cooldown prevention, and execution history tracking. Actions include webhooks, email, ticket creation, IP enrichment, and custom scripts.
Hunt Lead Generation
Auto-extract IOCs/IOAs from incidents and sessions. Generate hunt scripts for Windows (PowerShell) and Linux (bash), plus SIEM queries in Splunk SPL and Sigma rule formats. Bulk CSV export for threat hunting platforms.
IP Profile Investigation
Click any IP anywhere in the platform for instant full investigation -- GeoIP, threat intel, attack history, SSH sessions, and action buttons. One click to full context.
Automated Briefings & Analysis
Auto-generated daily threat briefings, plain-language incident narratives for executive consumption, and proposed playbook actions tied to detected TTPs. Designed to compress analyst review time, not replace analyst judgment.
Deployment Models
Deploy where your environment requires — cloud-hosted, on-premise, or fully air-gapped.
Hosted Control Plane + On-Prem Collectors
Control plane in the cloud with lightweight collectors inside your network. Outbound-only communication — collectors POST to the control plane, no inbound exposure. Decoys deploy inside your environment with zero external visibility.
Fully On-Premise (Air-Gapped)
All services on a single server inside your secured network. No external dependencies. Threat intel enrichment degrades gracefully when disconnected. Full Docker Compose stack included.
Integrations
| Category | Integrations |
|---|---|
| SIEM/SOAR | Splunk, Datadog, CrowdStrike, custom SIEM via webhook (JSON, CEF, syslog) |
| Notifications | Slack, PagerDuty, email (SendGrid), custom webhooks with HMAC signing |
| Threat Intel | AbuseIPDB, GreyNoise, Shodan, VirusTotal, ThreatFox, URLhaus, OTX, MISP |
| Export | CSV, JSON, STIX 2.1, Splunk SPL queries, Sigma rules, PDF reports |
The platform timestamps every detection, scoring, containment, and recovery event so MTTD, MTTC, MTTR, and blast radius can be measured and reported to the board. See the full cost model and executive reporting cadence on the reporting page.