Traffic Mirroring & IDS/IPS Integration
SPAN/monitor-port mirroring to Suricata, Zeek, Arkime, Strelka, and CAPE feeds a shared indicator store for retroactive block enforcement.
- Mirror targets receive a copy of traffic via SPAN/monitor-port with zero latency impact on live traffic.
- Detection adapters normalize analysis output to STIX 2.1 indicators.
- A shared, deduplicated, TTL'd, threat-intel-merged IOC store (Valkey) is read by inspection points to enforce retroactively on future traffic.
- Supports VXLAN/GRE/ERSPAN mirroring from the Go headend.