See everything on your network.
Know what's normal. Detect what isn't.
NetWatch combines Zeek protocol analysis, Suricata IDS with 49,000+ signatures, RITA-style behavioral analysis, passive asset discovery, and full PCAP capture into a single network monitoring platform with per-tenant isolation.
Core Capabilities
Four integrated engines working together to give you complete network visibility and threat detection without the noise.
Zeek Network Sensor
Full protocol analysis, connection logging, DNS monitoring, SSL/TLS inspection, and Community ID correlation across all monitored traffic.
Suricata IDS
49,000+ ET Open detection signatures with real-time alert streaming and protocol detection. Continuously updated rulesets tuned for enterprise environments.
RITA-style Behavioral Analysis
C2 beacon detection with jitter scoring, DNS tunneling identification via entropy and volume analysis, lateral movement detection, and data exfiltration detection.
Passive Asset Discovery
Automatic network inventory built from traffic observation. No agents, no scanning, no network disruption -- just visibility from what is already on the wire.
Behavioral Analysis Deep Dive
RITA-style analysis goes beyond signatures to detect adversary behavior that blends into normal traffic patterns.
C2 Beacon Detection
Jitter scoring algorithm identifies periodic callbacks even with randomized intervals. Detects low-and-slow beaconing that signature-based tools miss.
DNS Tunneling
Entropy analysis combined with query volume anomaly detection catches encoded data channels hidden in DNS traffic.
Lateral Movement
Internal connection pattern analysis identifies east-west spread across your network, surfacing attacker pivoting behavior.
Data Exfiltration
Outbound volume anomaly detection and unusual destination tracking identify data leaving your network through unexpected channels.
Infrastructure Intelligence
Automatically separate signal from noise with scanner identification and infrastructure traffic filtering.
Known Scanner Identification
GreyNoise-powered tagging identifies Shodan, Censys, and other known scanners automatically -- reducing noise and surfacing real threats.
Infrastructure Traffic Filtering
Nythrix infrastructure traffic is hidden from client views via BPF filters and tagging. You see your network, not ours.
PCAP Capture
Full packet capture with automatic rotation and BPF filtering for relevance. 24-hour retention provides forensic-ready evidence for incident investigation and regulatory compliance.
Per-Tenant Isolation
Each client's network data is completely separated. Tenant-scoped views and queries ensure no cross-tenant data leakage -- every query, every dashboard, every alert is scoped to your environment alone.
Ready for full network visibility?
See how NetWatch gives you complete visibility into your network traffic, threats, and assets.