Deployment
Wyvon: from the wire to your analysts — on your premises.
Wyvon is the harness that runs NagaHana at any scale. It collects passively, speaks the sensors you already own, keeps a record that can be verified, and puts each forecast in front of the people who decide.
01The path of a packet
Seven stages. One direction. Nothing sent back.
Telemetry flows one way — from your network into Wyvon, never back.
- 01
The wire
Your network, exactly as it runs today.
- 02
Capture
Taps and mirror ports copy traffic — optionally through a one-way data diode.
- 03
Sensors
Flow records, protocol logs and alerts from the sensors you already run.
- 04
Adapters
A thin adapter per source — adding a sensor never touches the model.
- 05
One record
Everything lands in one data model, with provenance and confidence on every field.
- 06
NagaHana
Memory and model: the world, forecast forward.
- 07
Your analysts
Forecasts, evidence and advice in the console. Decisions stay human.
02Passive collection
It listens. It is never in the way.
Nothing is installed on your hosts, and nothing sits in the path of your traffic. If Wyvon stopped, your network would not notice.
- 01
No agents
Not on servers, not on laptops, not on fragile control systems.
- 02
Out of band
Collection runs on its own plane, physically separate from the network it watches.
- 03
Data-diode ready
Traffic copies can pass through a one-way diode, so the monitor cannot be reached from the side it monitors.
03One data model
Every sensor, one language.
Different tools describe the same event in different ways. Wyvon translates all of them into one canonical record, so the model sees one consistent world.
- Zeek
- NetFlow
- Suricata
OCSF · network activity
- entity
- 10.119.51.20
- peer
- 10.119.10.8
- layer
- identity · kerberos
- action
- service-ticket request
- witnesses
- zeek · netflow
- event time
- 10:04:52.318 · clock ✓
Built on open standards
Records align with OCSF, the open cybersecurity schema, and extend it where networks need more.
Provenance on every field
Each value carries where it came from and how far it can be trusted.
Time put in order
Late, duplicated and out-of-order events are reconciled before the model sees them — and clock tampering is flagged, never silently corrected.
Two views of one record
A human-readable form for audit and investigation, and a compact form for the model — always in step.
Fits the stack you already run
Sensors & telemetry
- Zeek
- Suricata
- Snort
- NetFlow / IPFIX
- sFlow
- Packet capture
- Taps & SPAN
- Data diodes
Standards
- OCSF
- MITRE ATT&CK®
- STIX / TAXII
- EPSS
Intelligence
- Threat intelligence at the level of tactics
- Playbook matching — a lead, not a verdict
- Exposure-aware prioritisation
Product and standard names are trademarks of their respective owners and indicate compatibility only.
04Verifiable by design
Don’t trust the model. Check it.
Wyvon treats the model as something to be verified, not believed. Every stage of a forecast is committed to a tamper-evident record.
- 01
Inputs
Telemetry is signed and committed as it arrives.
- 02
Memory
Every change to memory is recorded and linked, so its history can be replayed.
- 03
Processing
The certified model’s execution can be attested and checked.
- 04
Outputs
Each forecast is signed and linked to the inputs, memory and model that produced it.
This proves the model ran exactly as claimed, on exactly this data. Whether a forecast was right is still for people to judge — and the record is what makes that judgement possible.
05It protects itself
The monitor is in its own threat model.
A security tool is a target. Wyvon is built on the assumption that someone will try to blind it, tamper with it or turn it.
- 01
Isolated management
Its control plane is separated, segmented and reachable only by the people who need it.
- 02
Tamper-evident logs
Its own records are append-only and chained, so any change shows.
- 03
Least privilege
Every component can do only what it must.
- 04
Honest about its health
When its own view is degraded, it says so.
06The analyst’s console
Built for the people who decide.
Not a chatbot. A visual workspace that shows exactly what the model believes, how sure it is and why — at the level of detail each person needs.
Forecasts
- 10.119.20.17471%
- 172.20.165.2638%
- 10.119.30.7822%
Evidence
- 01
Overview to internals
A situation view for the SOC; a drill-down into the model for specialists — the same state at two resolutions.
- 02
A world you can walk through
Move through any entity, any moment and any vantage point in your network’s history.
- 03
Uncertainty you can read
Confidence is shown the way people actually read it correctly — never as a bare number.
- 04
Trust, calibrated
It tells your analysts when to rely on it — and when not to.
07Lab
Rehearse the attack before it happens.
Alongside live deployment, NagaHana Lab runs on a digital twin of your network. It searches the ways an attacker could reach what matters, traces the strategy step by step and tests your counter-moves — without touching production.
- Pathways explored
- 0
- Most dangerous target
- —
- Blast radius
- —
- Best counter-move
- —
On-premises · passive
NagaHana Live
Continuous forecasting and forensics on your real network.
- Forecasts with likelihood and time to impact
- Rewind and investigate any moment
- Advice for analysts — never autonomous action
Digital twin · on demand
NagaHana Lab
Simulation on a faithful copy of your network, whenever you need it.
- Searches attack pathways toward critical assets
- Traces attacker strategy and blast radius
- Tests counter-moves before you commit to them
08Scale
From one site to a nation’s infrastructure.
Wyvon runs on your hardware, inside your perimeter, and grows with you.
- 01
Your hardware
Commodity servers and GPUs — no dependence on anyone else’s cloud.
- 02
Built to scale out
From a single segment to many sites under one view.
- 03
Sovereign by default
Your telemetry, memory and forecasts stay on your premises.
See what’s lurking in your network.
A private briefing, shaped around your environment.