Detection without certainty
Tools flag possible threats; teams still have to determine what actually happened.
Rhinexa Sentinel · Passive network detection and evidence
The independent witness to what happened on your network.
Rhinexa Sentinel reads a copy of your traffic from a mirror port, detects and correlates incidents, and keeps a tamper-evident record of what happened. It is never in the path and it sends nothing back.
- Deployment
- Appliance on a mirror or TAP port; multi-site sensors
- Networks
- IT, OT and clinical; air-gapped sites supported
- Evaluation
- Evaluate against a mirrored segment on infrastructure you control
- Grown from
- From our security operations practice
Sample dataThe problem
Detection is not enough. Organisations need evidence.
Tools may say "this could be brute force", but not what happened, when, where, or what forensic record proves it.
No complete forensic record
Alerts hint at an incident but rarely deliver a defensible record with proof.
Investigation after the fact
Teams reconstruct events across sources instead of having the context in one place.
What you get
Do not just detect the incident. Know what happened. Prove it.
Rhinexa Sentinel is the network detection and digital-forensics layer that sees activity, identifies what occurred, alerts your team and preserves the evidence.
Sees: what is happening on the network?
Every device that transmits is discovered from its own traffic: no agent, no credential, no scan, no asset register kept by hand.
Detects: what should you act on?
Known threats by signature, unknown ones by behaviour, and activity matched to current threat intelligence, with the nature of the incident identified.
Remembers: what evidence still exists?
Sessions and packets behind a finding are retained with a hashed chain of custody, so the record survives after systems are cleaned or contested.
Proves: can you demonstrate what happened?
Evidence indicators mapped to the regulations you are assessed against, on demand or on a schedule, backed by a forensic record.
How it works
From packet copy to forensic proof.
Six stages, in order, from the moment a copy of traffic arrives, so detection, investigation and evidence stay connected in one pipeline.
Capture
A mirror of your traffic arrives on a dedicated interface with no address: a one-way ear that transmits nothing back.
Decode
Sessions are reconstructed and protocols identified from what they are, including industrial protocols, not just the port used.
Detect
Signatures, behaviour and threat intelligence run together, so known attacks, unknown anomalies and current indicators are all covered.
Correlate
Related findings become one incident: entry point, systems involved, sequence and timeline, instead of dozens of disconnected alerts.
Retain
Sessions and packets are held with hashed exports, so the evidence behind a finding can still be produced months later.
Report
Evidence indicators mapped to regulatory clauses, on demand or on a schedule, as a signed document or as data for your GRC tools.
Capabilities
Detection with evidence, built into the pipeline.
Every capability below ships in the current appliance.
01
Passive network visibilityEvery transmitting device discovered from its own traffic: no agent, credential, scan or hand-maintained register.
02
One-way mirror captureReads a SPAN or TAP copy only. The capture interface has no address and transmits nothing back.
03
Protocol-aware decodeSessions reconstructed and protocols identified from behaviour, including Modbus, DNP3, S7, EtherNet/IP, BACnet, IEC-104 and OPC-UA.
04
Signature detectionKnown attacks and known-malicious infrastructure matched as traffic is observed, not after a host chooses to log it.
05
Behavioural detectionConnection rhythm, name-lookup entropy and transfer volume measured against each host's own learned normal.
06
Threat intelligence matchingObserved addresses and domains checked against current indicators, with the source attached so analysts can judge each finding.
07
Incident correlationRelated findings assembled into one case: entry point, systems involved, sequence and timeline.
08
Evidence retentionSessions and packets held so the proof behind a finding can still be produced months later.
09
Chain of custodyEvery export hashed and recorded so integrity can be demonstrated to investigators, insurers or regulators.
10
Compliance evidence mappingEvidence indicators mapped to regulatory clauses, stating only what was observed.
11
OT-safe by designNo inline path, no blocking, no probing. Reading a mirror is how you watch industrial and clinical networks without becoming a risk to them.
12
SIEM and workflow forwardingFindings forwarded to the SIEM and ticketing tools your team already uses.
Also included
- No agents required
- Air-gapped installation
- Signed offline updates
- Multi-site sensors
- Hardened appliance
- MFA and identity provider support
- Tamper-evident audit trail
- Encrypted internal services
Rhinexa Sentinel is
- Sees: devices discovered from their own traffic, without agent, scan or manual register
- Detects: known and unknown threats, with the incident identified and alerted
- Remembers: sessions and packets retained with a hashed chain of custody
- Proves: evidence you can produce for investigation, insurers or assessors
Rhinexa Sentinel is not
- Sit inline. It reads a copy and is not in the path of production traffic
- Block. It reports; your firewall and your team act
- Decrypt. It reads what is observable about a session, not its contents
- Scan or probe. Nothing is transmitted toward your devices, which matters on OT and clinical networks
Where it fits
Built for the environments teams actually run.
The same platform covers a single segment or a distributed estate.
OT and industrial networks
Watch production and process networks without probing controllers.
Unmanaged and embedded devices
Cameras, badge readers, printers, medical devices and contractor laptops, discovered from traffic where agents cannot run.
East-west movement
Traffic between your own systems after the perimeter is crossed: the longest phase of an intrusion and the one most tools miss.
Independent forensic evidence
Hashed packet and session records held outside the hosts involved, so evidence stands after logs are altered or deleted.
Air-gapped and regulated sites
Install, update and receive threat content from signed offline media.
Alongside existing tools
Next to firewall, EDR and SIEM, forwarding findings into the workflows you already run.
Deployment and security
Hardened. Auditable. Independent of the hosts it watches.
Native services on one appliance, no cloud dependency, and nothing that requires a route to the internet.
Never in the path
It reads a copy of traffic. Its failure does not affect the network it watches.
Air-gap ready
Installation, updates and threat content from signed offline media.
Hardened appliance
Each service runs under its own restricted account; internal communication is encrypted.
Separated roles
Administrator, analyst and viewer roles, with MFA and your identity provider.
Tamper-evident audit trail
Every security-relevant action recorded and verifiable on demand.
Evidence you can prove
Exports hashed and recorded so integrity is demonstrated, not asserted.
Questions
Frequently asked.
We already have a SIEM, NDR or EDR. Why Rhinexa Sentinel?
It sits alongside them, not instead of them. Findings forward to your existing tools. The question is whether anything today reports what actually crossed the wire, independently of the hosts involved, with evidence you can still trust after an intrusion.
Will it slow the network?
It is not in the path. It receives a mirror copy of traffic and transmits nothing back. If the appliance fails, the network it watches is unaffected.
Most of our traffic is encrypted. What can you see?
Who spoke to whom, when, how much, how often, over which protocol version and cipher, with which certificate, and in what rhythm. Beaconing, bulk data leaving and lateral movement are visible in that shape without reading contents. Rhinexa Sentinel does not decrypt, and you should be sceptical of anyone who claims otherwise.
Can it run on an air-gapped network?
Yes. It installs, updates and receives threat content from signed offline media, with no internet route required.
Do we need agents on devices?
No. Discovery and detection come from mirrored traffic. Devices that cannot take an agent are still visible because they talk on the network.
How is evidence different from logs?
Logs are written by the machine being attacked. A network record is captured from a traffic copy on a device that account never touches, then hashed so integrity can be shown rather than argued.