feature capture
Overview Use Traffic for real-time network visibility and anomaly investigation on desktop. Start capture during analysis windows, inspect suspicious sessions deeply, and dismiss only validated benign activity.
Description: Use Sunburst for live macro traffic awareness. Start capture, filter by protocol/status, and drill into suspicious clusters.
| List View | Detail View |
|---|---|
 |
 |
Screenshot of Sunburst – Live Traffic Visualization - Multi-pane layout showing list and detail views
-
Start/Stop Capture
- Start/stop capture intentionally during investigation windows and confirm prerequisites first.
-
ML Anomaly Detection – Extended Isolation Forest
- Treat anomaly scores as triage signals, then validate context before taking action.
-
Whitelist Profiles – Expected Traffic
- Use whitelist profiles to encode expected traffic and reduce false positives safely.
Description: Use Sessions for forensic-level review of individual connections. Inspect details deeply before deciding to dismiss or escalate.
| List View | Detail View |
|---|---|
 |
 |
Screenshot of Sessions – Connection Details Table - Multi-pane layout showing list and detail views
-
Session Details – Deep Inspection
- Use deep session details to confirm who connected, to what, and why before decisions.
-
Dismiss – Mark Session as Safe
- Dismiss only sessions positively verified as legitimate, and prefer narrow dismissal scope.
Description: Use this view to baseline network behavior by application. Investigate processes with unusual volume or unexpected destinations.
Screenshot of Processes – Per-Application Traffic
Description: Use anomaly history as your investigation queue. Work recent abnormal events first and dismiss only with supporting evidence.
| List View | Detail View |
|---|---|
 |
 |
Screenshot of Anomaly history – Flagged Sessions - Multi-pane layout showing list and detail views
This page was automatically generated from feature definitions.