Real-time packet capture, deep protocol decode, and AI-powered threat detection — from a single laptop to hundreds of production servers.
curl -sSL https://netscope.ie/hub-quickstart.sh | sh
| Time | Proto | Source | Destination |
|---|---|---|---|
| 20:09:56.421 | DNS | 172.20.10.8:53201 | 8.8.8.8:53 |
| 20:09:56.198 | TLS | 172.20.10.8:52901 | 142.250.80.46:443 |
| 20:09:55.991 | HTTP | 172.20.10.8:51204 | 192.168.1.1:80 |
| 20:09:55.855 | ICMP | 172.20.10.8 | 1.1.1.1 |
| 20:09:55.612 | gRPC | 10.0.0.5:54221 | 10.0.0.9:50051 |
| 20:09:55.301 | TLS | 172.20.10.8:52899 | 35.186.224.47:443 |
No Kubernetes. No YAML. One command starts the full stack.
One curl starts ClickHouse, Kafka, the API, and the web dashboard in Docker. A random API key is generated automatically.
curl -sSL https://netscope.ie/hub-quickstart.sh | shGenerate an enrollment token in the dashboard. Run the install command on any target machine — Linux, macOS, or Windows.
curl -sSL "https://hub/install?token=…" | INTERFACE=eth0 shFlows appear within seconds. Ask the AI Copilot questions in plain English. Set alert rules, write Sigma detections, export to SIEM.
Dashboard at http://localhost — open in browserEvery component works standalone. Together they give you complete, fleet-wide observability.
A native Tauri + React explorer for macOS and Windows. Browse live traffic, view connection graphs, inspect TLS certificates, and run HTTP analytics — no terminal required.
A zero-overhead Rust sensor. Runs in pcap mode on any platform, or eBPF mode on Linux for process attribution and kernel-level visibility. Sends compressed flow telemetry with no local storage.
A self-hosted control plane aggregating flows from your entire fleet. AI Copilot, anomaly detection, Sigma rules, custom dashboards, SSO/SCIM, compliance reporting, and SIEM export.
From raw packets to actionable security intelligence — in real time.
Full documentation →Sub-millisecond latency from packet to dashboard. pcap on all platforms, eBPF on Linux for kernel-level visibility without copying to userspace.
HTTP hostnames, DNS queries, TLS handshakes, gRPC method names, HTTP/2 streams, ICMP types, ARP. See the conversation, not just IP headers.
eBPF maps every connection to the process, PID, binary, and user. Know exactly which app is phoning home or exfiltrating data.
Ask questions in plain English. The Claude-powered copilot translates your question into ClickHouse SQL, runs it, and explains the results inline.
MaxMind GeoLite2 enrichment on every flow. AbuseIPDB lookups flag known-malicious IPs with colour-coded threat badges before they escalate.
Write detections in standard Sigma format or use 5 built-in rules. Get real-time alerts on port scans, DNS tunnelling, C2 beaconing, and more.
7-day rolling Z-score baseline per agent and protocol. Automatic spike detection flags unusual traffic volumes within 5 minutes.
Build your own views with 6 widget types: stat cards, flow-rate charts, protocol pies, top-talkers, alert feeds, and anomaly feeds.
The AI Security Copilot translates plain-English questions into ClickHouse SQL, executes them against your live flow data, and explains the results — all in a streaming side panel.
Powered by Claude — runs inside your hub, API key never leaves your server
SELECT-only enforcement — injected SQL is validated before execution
Multi-turn tool use — runs up to 5 queries per question, shows live SQL cards
Use the agent from the terminal during incident response, or let the hub aggregate everything automatically.
Physical NICs, virtual bridges, container network namespaces, loopback. Works in Docker, K8s pods, and bare metal.
All flows land in ClickHouse. Run ad-hoc queries from the AI Copilot or any SQL client. Export to CSV, hook up Grafana.
Hostname resolution, GeoIP, ASN, threat intel, and process attribution all happen server-side — the agent stays lean.
Every plan includes the desktop app, capture agent, and self-hosted hub. No vendor lock-in, ever.
Deploy in two minutes. No credit card, no sign-up, no telemetry sent anywhere.