Network sensor
The map of your network, and the moves of an attacker travelling across it
The sensor is connected to a mirror port or a passive TAP: it sends nothing onto your network. It learns your devices and who talks to whom, then flags anything out of the ordinary. No content is kept: only who talks to whom, when, how much and over which protocol.
- Free-form map and view by sites and segments; new devices, refused flows and devices named in a detection highlighted
- Passive inventory: address, manufacturer, ports, estimated role, without ever probing a device
- Six rules: blind sensor, known intrusion, scan, DNS tunnel, lateral movement, new device
- Learning period of 14 days, then every new item is approved or refused by an analyst
- Traffic by protocol over 24 hours or 7 days, sensor health and capture losses
Example — demo client
An Internet address scans 412 ports and tries to exploit the firewall's VPN flaw; the next day, the ERP server opens never-before-seen connections to the file server and the NAS: a ‘lateral movement’ alert and a red link on the map.
Set-up: A capture card on the collection machine, linked to a mirror port or a TAP: up to 200 Mbit/s on the collection machine, 1 Gbit/s on a dedicated machine. Impact assessment and staff information before connecting; the network map is reserved for LuxGap analysts, while detections are alerts you can see.
LuxGap SOC — Monitoring console
