Networks leave a trace.SATO connects the events.
Zeek-based network analytics: from an IOC match to related sessions.
Explore the scenarioNetwork trace192.0.2.24
- dns
beacon.example - conn
203.0.113.42:443 - ssl
beacon.example - iocIOC match found
Every alert links back to its source event.
beacon.example
IOC match
- Field
dns.query- Source
- Demonstration IOC dataset
- Host
192.0.2.24
From domain to connection
Host
192.0.2.24dns / conn
beacon.example
203.0.113.42Related sessions enrich the alert in a separate correlation pass.
Source DNS event
{
"uid": "Cdemo7k2p",
"id.orig_h": "192.0.2.24",
"query": "beacon.example",
"answers": ["203.0.113.42"]
}For security teams that need context behind network events.
Project in developmentKeep the context behind every alert.
SATO brings network events, indicators of compromise and related connections into one investigation workflow.
conndnshttpsslfiles
- Inspect the source events
- Zeek logs, search, filters and nested grouping to explore network data.
- Find IOC matches
- Match IP addresses, domains and hashes against indicators of compromise.
- Follow the context
- Move from an alert to related sessions and the source record behind the detection.
Inside your infrastructure.
The planned v1 is designed for self-hosting and an in-house security team.
Zeek sensors
Network events
SATO
IOC detection and correlation
Analyst
Search and investigation
Planned architectureIPv4 and IPv6 support planned for v1
Foundation first.
Then expansion.
We are building a standalone first version. There is no public release yet.
- Now
Validating the foundation
Lab validation of event delivery and secure sensor ingestion.
- First version
SATO network analytics
Alerts, IOC detection, Zeek logs, related sessions, search and dashboards.
- Next
TI and Inventory
Separate stages of development after v1.