Where do our systems communicate to?
See in the captured traffic which internal systems contact external destinations — including connections to destinations known to be malicious.
AEGYS Pulse · Network analysis
Which connections deservea second look?
An internal system contacts an unusual destination. New communication appears between network segments. A data flow deviates from its usual behaviour. AEGYS Pulse surfaces such anomalies in captured network traffic and gives your team starting points for investigation.
Guided trial in your own network. We clarify prerequisites and scope together.
Passive capture · No agents on endpoints · Analysis in Germany
QUESTIONS
From network traffic to a concrete question.
Which communication is changing?
Look into new connections, unusual data volumes and deviations from previous communication behaviour.
Which internal connections stand out?
Follow up on notable communication between internal systems, as far as it is captured at the chosen measuring point.
A notable pattern is a reason to investigate. The assessment happens in the context of your environment.
SAMPLE ANALYSIS
How anomalies become easy to review.
The analysis groups recorded alerts by type and frequency. This helps your IT team put anomalies into context and investigate them in a targeted way.
What your team can examine in a finding.
- 01
Observation: The view shows documented exploit attempts over time. Attempts are not proven successful attacks.
- 02
Context: For the assessment, the systems involved, the affected connections and the timing within the operating picture of your environment are relevant.
- 03
Investigation: This leads to a concrete next step: trace the affected systems and connections specifically and match them against known activity in your environment.
INTEGRATION AND OPERATION
An additional perspective for your security architecture.
Pulse captures a copy of the network traffic via a SPAN/mirror port or a network TAP. Your existing protection stays in place. Which areas become visible depends on the measuring points and the network structure.
- 01
Define the capture scope
Together with your IT team we clarify which network segments and communication paths should be covered. With multiple sites or segmented networks, placement is agreed accordingly.
- 02
Set up the capture
Your IT team provides the suitable mirror port or TAP. The connection to the analysis platform and the operational prerequisites are clarified before connecting.
- 03
Agree on analysis and responsibilities
Before deployment we define who reviews the findings, how results are discussed and who takes on further investigation or measures: your team, your service provider or an agreed security partner.
Continuous capture describes the technical observation. Scope of support, analysis cadence and response paths are agreed separately.
“Runs in the background, we don't notice it — and that was exactly the point. We wanted visibility without having to look after it ourselves.”
DATA PROCESSING
What is captured. Where it is analysed.
In standard operation
- In standard operation: connection metadata such as source, destination, time, protocol and volume.
- Encrypted transfer for analysis in Germany.
- Extended capture only by explicit agreement.
- Visibility within the network traffic actually captured.
Technical limits
- AEGYS Pulse does not block productive traffic.
- Passive network capture provides no direct view of local processes and files.
- Encrypted content is not decrypted.
- Network segments that are not captured lie outside this view.
The statement that no content is captured refers to standard operation with connection metadata. Extended modes such as deep packet inspection or PCAP recordings are used only by explicit agreement.
Architecture and data processingDETECTION
How anomalies are detected.
Signature matching
Checks captured network data against known attack patterns.
Behavioural analytics
Identifies deviations from usual communication behaviour.
Threat intelligence
Matches observed connections against known threat indicators.
GETTING STARTED
Assess the value in your own environment.
In the guided 21-day trial you see which findings Pulse delivers within the agreed capture scope. You then decide on further deployment.
FREQUENT QUESTIONS
Technical details at a glance
NEXT STEP
Which connections would you like to understand better?
Talk to us about your environment and your reason for looking. Together we clarify a sensible capture scope and the right way to start.
Background: positioning NDR, SIEM and SOC correctly