Jizô AI

Captures and retains full packets (PCAP) at scale alongside flow and metadata records, with long-term retention and session reconstruction or replay, so analysts can pivot from an alert to the exact underlying packets and run retroactive investigations against historical traffic. Metadata-only products that retain no packets do not qualify.

Runs traditional detection alongside behavioral analytics: intrusion-detection signatures (Suricata or Zeek rule sets and vendor IPS signatures), rule-based heuristics, and threshold alerts, with support for importing community rules and authoring custom rules, so known exploits and indicators are caught deterministically and analysts can codify their own detections.

Discovers every device communicating on the network and assembles a continuously updated inventory with device type, role, protocols in use, and communication paths, grouping and tracking entities across address changes (for example through a knowledge graph) and tagging criticality and exposure, so risk scoring and investigations start from an accurate map of what is on the network.

Discovers and inventories cyber-physical system assets (OT, ICS, IoT, and medical devices) and their communication channels from the same sensors that monitor IT traffic, baselines normal CPS activity and alerts on deviations, and parses industrial protocols (Modbus, DNP3, EtherNet/IP, PROFINET, IEC 61850, OPC UA) for deep inspection, so IT and CPS attacks are detected and correlated in one NDR console. Protocol depth and CPS asset detail vary widely across NDR products.

Executes containment automatically on confirmed detections: isolating infected hosts, blocking malicious traffic, or disabling compromised accounts, either natively (for example through the vendor's own switches, firewalls, or inline sensors) or through integrations with firewalls, NAC, EDR, SASE or SSE, and SOAR platforms. Whether enforcement is native or integration-dependent is the primary buying distinction.

Uses an AI assistant to qualify and triage network detections inside the NDR console, explaining each anomaly in plain language, assembling related detections into an incident narrative, and recommending the next investigation or response step, so analysts spend less time on first-pass triage of network alerts.

Runs behavioral detection, machine-learning models, and AI assistance entirely on local sensors and management appliances, with no cloud-tethered analysis or external data sharing, so detection quality is undiminished in air-gapped, sovereign, or disconnected environments.

Aggregates related network alerts into structured incidents that link the hosts, accounts, and detections of one attack, reducing alert volume and giving analysts one case to investigate and respond to instead of disconnected events.

Renders the network events, entities, and detections of an incident on an interactive timeline or attack graph, so analysts can reconstruct the sequence of an intrusion across hosts and time and see the path an attacker took through the environment.

Matches observed traffic against continuously updated threat-intelligence feeds, both the vendor's global intelligence and customer-imported internal or third-party feeds, to recognize malicious infrastructure, command-and-control patterns, and known indicators, and enriches detections with the matching intelligence context.

Detects threats inside TLS-encrypted sessions either without decryption, through JA3, JA4, and certificate fingerprinting plus behavioral analysis of encrypted flows, or through on-appliance decryption where keys are available for full payload inspection. Fingerprint-only analysis is now standard across NDR; on-appliance decryption, JA4 support, and detection quality on encrypted command-and-control are the differentiators.

Shows analysts the reasoning behind each machine-learning or behavioral detection, such as the baseline deviated from, the contributing signals, and the model's confidence, so alerts can be validated and tuned rather than trusted as opaque outputs.

Parses raw traffic with deep packet inspection into structured, protocol-level metadata records, such as Zeek-style connection, DNS, HTTP, and TLS logs, and enriches them at collection or analysis time with asset, user, geolocation, and threat-intelligence context, producing hunt-ready evidence that is retained far longer than packets and exportable to a SIEM or data lake.

Learns per-entity baselines of normal network behavior for devices, users, and applications, typically with unsupervised or self-learning models that need little manual tuning, and detects deviations that reveal insider threats, external attacks, and advanced persistent threats, including novel command-and-control, data staging, and lateral movement. Detection quality separates products: self-learning models with minimal tuning versus rule-primary engines with limited machine learning.

Extends network detection to cloud VPC traffic using VPC flow log analysis, cloud-native sensors, or mirroring, covering east-west traffic between cloud workloads.

Dissects OT protocol payloads at the function code level, detecting unauthorized read/write operations, unusual register ranges, and firmware upload commands in Modbus, DNP3, EtherNet/IP, PROFINET, and OPC-UA traffic.

Discovers and identifies OT assets, including nested devices behind controllers, with manufacturer, model, serial number, firmware and version detail, using passive traffic analysis first and, where the product supports them, OT-safe methods such as selective active querying, controller project-file parsing, lightweight host executables and switch or firewall telemetry. Passive-only versus multi-method discovery and the depth of identification vary widely.

Provides curated intelligence on adversary groups, malware and vulnerabilities that specifically target industrial control systems, with detections, playbooks and recommended actions tied to that intelligence and, in some products, community sharing of threats observed across other OT environments.

Connects OT security to enterprise security operations either as a single converged console for IT and OT or through integration paths into SIEM, SOAR, ITSM, CMDB, NAC and firewall tooling, forwarding alerts and asset data with OT context (asset criticality, Purdue level, process impact) preserved so that SOC analysts can act without OT specialization. Assign only when integrations preserve OT context or run bidirectionally; basic syslog forwarding is standard across the niche.

Retains OT-specific evidence for investigations, including protocol-level packet captures, controller commands, asset criticality and process context, and guides response with OT-aware playbooks whose containment actions respect safety and uptime constraints rather than defaulting to IT-style isolation.

Baselines normal device communication patterns (command frequency, connection pairs, timing) and operational state, alerts on deviations that indicate reconnaissance, manipulation or lateral movement, and rates severity by asset criticality and process impact rather than by anomaly size alone. Products differ in whether baselines self-tune over time to operational and environmental changes or require ongoing manual tuning.

Monitors control networks without adding latency or traffic, using passive SPAN or TAP collection and out-of-band sensors, and keeps full detection, analysis and reporting working at disconnected, air-gapped or intermittently connected sites through fully on-premises operation. Cloud-reliant products lose function at isolated sites; isolated-site-capable products do not.

Maps actual traffic flows between IT and OT zones and between Purdue model levels, revealing unauthorized cross-zone connections and segmentation failures.