The evidence plane: normalized observations and retroactive PCAP
A finding is only as good as the evidence you can pull back for it. Cernity ships a canonical evidence plane — one normalized record for every observation — and a retroactive packet buffer so the raw packets behind a finding can be preserved after the fact. Together they let an analyst move from “a detector fired” to “here is exactly what was seen, and here are the packets.”
One canonical record: observation.v1
Sources differ — a Suricata flow summary, a DNS transaction, a TLS handshake, and an HTTP request
carry different fields. Cernity normalizes them into a single observation.v1 record and exposes a
unified view over the typed records:
| Typed record | Represents |
|---|---|
| connection | An L3/L4 flow: endpoints, ports, byte and packet counts, duration |
| DNS | A query/answer transaction with the client identity |
| TLS | A handshake: SNI, certificate and version metadata, fingerprints where present |
| HTTP | A request/response shape: method, host, URI structure, status |
The point is a stable shape a finding can always point back into, regardless of which detector produced the finding or which source emitted the underlying event.
Capability flags: no source fakes a field
Not every source can observe everything. A flow record has byte counts but no HTTP URI; a source with app-layer blindness cannot report a TLS SNI it never parsed. Each typed record therefore carries capability flags that declare exactly what its source supports.
This is a correctness guarantee, not decoration. An evidence-poor source never fabricates a field it did not observe — the flag says “not supported here,” which is different from “observed and empty.” When an analyst sees a missing field, the capability flag distinguishes the sensor could not see this from the sensor saw this and it was absent.
The evidence query API
A read-only evidence query API lets you pivot from a finding to its underlying normalized observations, filtered by:
- entity — the asset or address the finding is about,
- time — the window around the finding, and
- type — connection, DNS, TLS, or HTTP.
This is the mechanism behind Vantage’s evidence-pivot view: from a finding, an analyst pulls the normalized observations for that entity, window, and type and reads the actual records. It is a filtered pivot into the underlying evidence — not a claim to reconstruct the exact records that contributed to any one aggregate count.
The baseline evidence plane is Suricata-derived plus central derivations. Continuous Zeek is an optional mode for deeper protocol evidence, not a prerequisite for the plane to function.
Retroactive packet capture
Standing full-packet capture is expensive and usually wasteful — most flows never matter. Cernity’s approach is a bounded, budgeted pre-trigger rolling packet buffer on the sensor: it continuously holds a limited window of recent packets, so when a finding fires, the packets from before and around it are still available.
The flow:
- A finding warrants packets. The finding-service issues a
capture-request.v2. - The sensor satisfies it from its rolling buffer — capturing the window that already elapsed, not just packets going forward. You did not have to predict, in advance, that this flow would matter.
- Preserved packets are stored under tenant-safe object keys.
- Retrieval is authenticated and audited — every access to preserved packets is attributable.
Two honest constraints:
- The buffer is bounded and budgeted per sensor. You can only recover packets still inside the window and within the sensor’s capture budget; this is deliberate, not standing capture.
- This capability is shipped in code. Live end-to-end preservation — buffer → request → store → authenticated retrieval — is verified in a full deployment, not asserted for every environment.
What this is not
- It is not decryption. Preserved packets and normalized records expose what the traffic revealed, not payload the sensor could not see.
- It is not unlimited retention. The rolling buffer trades total history for the ability to reach backward a bounded amount without paying for standing capture.
- Whether a given field is present still depends on the source’s capability flags and your sensor configuration — see capability dependencies.
For how analysts use the plane during an investigation, see the analyst workflow; for where it sits in the pipeline, see how Cernity works.