A Complete Packet Capture Appliance
& Network Security Platform

Overview

SentryWire is a Full Packet Capture Appliance and Network Security Platform that is based on a unique capture and storage architecture which breaks the performance, scalability and expense barriers of existing frameworks. SentryWire supports capture rates from 1Mbps to +1Tbps, while providing real-time filtering and allowing retention of network traffic for weeks, months and even years at price points that can be less than 50% the cost of other systems.

Imagine a Hadoop like architecture that is engineered to scale out compute and storage to provide the fastest search in the industry even in packet stores of 100PB's. The SentryWire system has high-speed packet recording with real-time analytics, visualization, and BPF-syntax filters. The system detects intrusions, minimizes damage caused by breaches and enables complete packet level analysis of any incident.

The SentryWire Packet Capture Platform allows an extended timeline of traffic to be recorded and analyzed at commodity prices using new or existing analytics. Why is it important to have an extended timeline of packet traffic stored? Because we know on average it takes 146 days to detect certain state sponsored intruders in a network and without a high fidelity recording of the network traffic enterprises cannot make a definitive determination of when intruders got in, how they got in or exactly what data was ex-filtrated.

Threat
Hunting

Incident
Response

Network
Troubleshooting

Carrier Grade
Solutions

Full Packet Capture

Capturing just Metadata does not
produce a high fidelity record of Traffic.

Powerful & Fast Search

Search Petabytes of Network Traffic
in Minutes.

Extended Timeline

Network Traffic Stored for Weeks,
Months or Years.

Fast Capture Speed

Capture Speeds from 1Mbps to +1Tbps.

Intrusion Detection

Present Day Intrusion Detection limits Breaches.

Visualization & Analytics

3D Visualization + Integrated Commercial, Open Source & Custom Analytics.

IDS Search Back

Use IDS signatures to search back across previously recorded packets to forensically detect & identify events using attributes and indicators relevant to today.

Network Operations

Collect packets and produce a variety of logs to track network performance metrics.

Artifact Extraction

SentryWire does not truncate or slice any packets it captures, this allows for the return of fully sessionized PCAPs & provides the ability to extract file artifacts with ease via the UI.

Full Network Packet Capture

Line rates 1Mbps to +1Tbps, lossless and continuous capture. This isn't just packet inspection and retention of the meta data from that inspection - we capture and store all the network IP Packets so it can be filtered against known signatures and also be continuously inspected and analyzed for signatures that materialized after the traffic was filtered, collected and stored. We know, on average, perpetrators are in the network for 146 days before being discovered, so it's critically important to have an extended timeline of packets available for analysis.

Extended Packet Capture Timeline

Forensics for incident response and post-breach activities. Even with the best enterprise security tools deployed in multiple layers and depth, organizations that are breached find they need to reach back more than 146 days from the discovery of the breach to get to the root of the problem and determine which data were accessed and exfiltrated. Or for the non-security use cases, unscheduled outrage root cause analysis often requires a similar timeline of high fidelity data to be accessible. SentryWire provides real-time filtering, logging and retention of network traffic for weeks, months and even years at price points that can be less than 50% the cost of other systems.

Fast Capture Speeds

We guarantee the best lossless capture performance on the market. Our capture rates, as well as the rates we move the packets around inside the appliance and the cluster nodes, have been architected and engineered to continuously capture, even the burstiest traffic. We can scale to the fastest current market bandwidths (100Gbps to +1Tbps) and our architecture can continue to grow with network bandwidth capabilities.

Intrusion Detection

SentryWire uses Suricata, an open source, mature, fast and robust network threat detection engine. Suricata is capable of real time intrusion detection (IDS), network security monitoring (NSM) and offline PCAP processing. Suricata inspects the network traffic using a powerful and extensive rules and signature language, and has powerful Lua scripting support for detection of complex threats. With standard input and output formats like YAML and JSON integrations with tools like existing SIEMs, Splunk, Logstash/Elasticsearch, Kibana and other database become effortless.

Compliance

SentryWire can help support an organization’s audit and compliance requirements by maintaining an authoritative record of network activity.  Whether focusing on North/South or East/West network traffic, SentryWire’s ability to capture and store hundreds of day’s worth of traffic provides auditors with definitive evidence of what took place in your network.

Visualization & Analytics

With SentryWire's Application Node and our RESTful API you can instrument to the world's leading commercial, open source and custom visualization platforms including 3D interfaces that allow security engineers to isolate anomalous activity. SentryWire's instrumentation to existing tools provides log correlation and aggregation visualization solutions with fast and seamless access to metadata logs.