Your network
has a story.
Find the threat.
Turn Suricata telemetry into explained security findings. Behavioral detection, context, and consolidation. Delivered to your SIEM.
Self hosted / Source available / Built on Suricata
Periodic callback detected
10.0.0.5 → 203.0.113.66:443
From network activity
to something you can investigate.
Suricata inspects the traffic. Cernity connects the observations into findings your security team can work with — across evidence, detection, intelligence, files, and analyst operations.
See the full platformStart from the record on the wire.
A canonical, queryable evidence plane over your network — with rolling-buffer PCAP you can retrieve after the fact.
02Find the pattern across the packets.
Behavioral detection, explainable ML anomaly, Suricata IDS signatures, and MITRE ATT&CK mapping on the same telemetry.
03Match what is known, hunt what is past.
A managed indicator lifecycle — STIX/TAXII, MISP, HTTP feeds — matched live and hunted retrospectively.
04Scan the files on the wire.
A first-class file-artifact store, central YARA scan workers, a signed rule registry, and file-hash intel.
05Give an analyst what they need.
Vantage — a source-available workspace — plus fleet management and per-entity enrichment.
06Deliver findings where you work.
Splunk, Elasticsearch, OpenSearch, Devo, Syslog/CEF, and webhooks — with CIM/ECS content packs and pivots.
Detection you
can defend.
Evidence behind every finding, ML you can explain, infrastructure you own, and no lock-in.
Evidence-first.
Every finding has a reason — the record, the measurements, and the ATT&CK context that produced it.
Explainable ML.
Anomaly scores come with per-finding provenance from deterministic cohorts and dual baselines — never a black box.
Self-hosted & source-available.
You run the infrastructure and control retention. The code is source-available.
Keep your SIEM.
Findings flow into the tools your team already uses. No lock-in.
Keep your sensors.
Keep your SIEM.
Add a central detection tier. Sensor telemetry comes in; explained findings go out. You run the infrastructure.
Inside the architectureSuricata
Packet inspection
EVE telemetry + shipper
Cernity.
Detect · Enrich · Consolidate
EXPLAINED FINDINGSYour SIEM
Investigation
Your existing workflows
01 Analysis runs centrally
02 You control data retention
03 Optional packet forensics
Look at the output.
Then judge the signal.
Seven record-level case studies from synthetic capture replays. The same traffic, with and without Cernity.
A cadence becomes a finding.
20 connections. Zero Suricata alerts for this pair. Three beacon findings as the window developed.
Inspect the comparison ↗REPEATED SIGNATURE45 → 1Repeated alerts, one identity.
45 signature alerts consolidated into one tracked finding, with two revisions.
Inspect the comparison ↗These scenarios demonstrate detection and consolidation, not production accuracy. False leads occurred in the same test. Read the scope and limitations →