One signal, not multiple dashboards.
Tessaract is a passive network security appliance. It runs four detection engines against the same traffic, correlates what they find into a single scored case, and maps every finding to MITRE ATT&CK, CAPEC, and D3FEND. Built to run fully disconnected, for the networks that can't be.
Every detection engine sees something different. None of them sees everything.
Running them side by side means separate consoles, separate alert queues, and an analyst doing the correlation by hand. Tessaract does that correlation first. The case that reaches you is already the answer, not the raw material.
Zeek
Full protocol-level traffic logging. The record of what actually happened on the wire.
Suricata
Signature-based detection against Emerging Threats rulesets, tuned for the traffic being observed.
Sigma
Vendor-neutral detection logic, matched against network-layer events as they are generated.
Event Log Analysis
Windows event log timeline analysis, for the host-side half of an incident the wire alone won't show.
From raw packets to a scored case, on one appliance.
Tessaract runs continuously and autonomously. Analysts start each shift with a ranked queue instead of a flat wall of alerts.
Capture
A SPAN or mirror port feeds traffic in. Tessaract never sits inline and never touches the network it watches.
Detect
Zeek, Suricata, Sigma, and Event Log Analysis examine the same evidence, each contributing what it does best.
Enrich
Findings are mapped to ATT&CK techniques, CAPEC patterns, and D3FEND countermeasures, with offline GeoIP and ASN context.
Score
Related detections merge into one case with a single 0 to 100 confidence score from our patent-pending scoring model. Independent corroboration counts for more than raw alert volume.
Report
Each case produces a structured, technique-mapped report ready for the analyst or the client.
The Tessaract dashboard: recurring detections grouped across cases, each ranked by confidence.
Built for analysts who need answers, not more alerts.
Invisible sensor
The capture interface carries no IP address and transmits nothing, so it can't be scanned or targeted from the monitored network.
Confidence-ranked cases
Every case gets a single 0 to 100 score, so the queue tells your team exactly where to start.
Cross-case memory
Cases are indexed by technique, rule, country, and ASN, so patterns that span shifts, weeks, or months surface on their own.
Mapped reporting
Per-case and periodic daily, weekly, and monthly reports, with techniques, attack patterns, and recommended countermeasures.
Network exposure analysis
Correlate router, switch, and firewall configurations and vulnerability scans into a topology map that highlights unexpected ingress, egress, and IT/OT boundary paths.
Tunable to your environment
Detection rule sets and alerting thresholds adjust per deployment, without rebuilding the appliance.
Every update ships as a file, not a connection.
Most detection platforms assume live internet access for rules and threat intelligence. Tessaract assumes the opposite. It is built for networks that are disconnected on purpose: industrial control systems, classified environments, and sites where isolation is the security posture.
- Detection rules and MITRE knowledge bases update from prepared media, not a live feed.
- Every update backs up the running configuration first and verifies before going live, rolling back automatically if verification fails.
- Licensing works the same way: install a signed license file. There is no phone-home check.
- GeoIP and ASN enrichment run entirely on the appliance.
- First boot detects your hardware and network interfaces automatically.
- The same software runs on a laptop evaluation or a rack at a client site.
Deploy it the way your environment requires.
Virtual appliance
A single OVA. Import it, attach a management and a capture interface, and traffic analysis starts automatically.
Your hardware
Install from ISO onto your own server for permanent sensor deployments.
Prebuilt appliance
A compact, ready-to-rack sensor delivered configured for your site. Contact us for availability.
Try Tessaract for 10 days.
Import the appliance, point it at a mirrored port, and see what it finds. No sales call required to get started.
socks@ephemeralnetworks.com