One platform for the
whole investigation.
From the raw record that crossed the wire to the explained finding in your SIEM — evidence, detection, intelligence, files, and analyst operations, self-hosted and source-available.
Start from what
actually crossed the wire.
A canonical, queryable record of your network — and the packets behind it when you need them.
Every record, one canonical view.
A single typed observation.v1 view over your network records, served through a read-only evidence query API.
02Pull the packets after the fact.
A rolling-buffer PCAP store lets you retrieve full packet capture for a finding after the fact, via a capture-request.
More than one way
to catch a threat.
Behavioral analysis, explainable ML, signatures, and ATT&CK mapping working the telemetry your sensors already produce.
Find the pattern across the packets.
Detect beaconing, distributed transfer, and internal fan-out with DNS, HTTP, TLS, protocol, and east-west detectors.
02Every score carries its reason.
Dual baselines and deterministic cohorts produce per-finding provenance, so every anomaly score stays explainable.
03Signature alerts, promoted to findings.
Suricata IDS signature alerts are promoted into first-class Cernity findings alongside behavioral detections.
04Inspect the detection catalog.
Manifest-declared detector status, ATT&CK techniques, and input records, with coverage boundaries made explicit.
05Inspect the detection quality scoreboard.
Manifest-derived status and measured precision/FP where dispositions exist, with insufficient data stated explicitly.
Match what is known.
Hunt what is past.
A managed indicator lifecycle applied to live traffic and to the evidence you have already captured.
The files,
not just the flows.
File artifacts pulled from the traffic, scanned centrally, and kept as evidence.
Everything an analyst
needs to run it.
A workspace to work findings, a fleet to keep healthy, and context on every entity.
Work the queue, see the evidence.
Vantage is a source-available workspace with queue, dashboard, evidence, fleet, coverage, and case views, plus deterministic investigation playbooks.
02Know every sensor’s state.
A central sensor registry with health heartbeats, a read-only fleet API, and clock-skew flagging.
03Context on every entity.
Reverse DNS, registration age, GeoIP, ASN, fingerprint naming, and reputation, attached to the finding.
No lock-in.
Findings go to you.
Delivered into the SIEM your team already uses, with the content packs to make them useful.
You run it.
You control retention.
Cernity is self-hosted: you deploy the central tier on-prem, in a VM, or as a container, and you decide what data is kept and for how long.
Plan your deployment and sensor placementROADMAP Cloud & flow-log sensor classes for cloud coverage are on the roadmap — not shipped today.
ROADMAP Response orchestration and optional LLM summarization (an “AI SOC”) are on the roadmap. Today, SOAR/webhook forwarding hands findings to your existing response tooling.