Stop a DDoS attack at your upstream, not on your own uplink
The system recognises an attack, names it and can stop it before it fills your link – via RTBH or FlowSpec at your upstream peer.
From detection to response within seconds
The system does not only detect. It can stop an attack at your upstream peer — before it saturates your uplink.
- RTBH blackhole — announce the prefix upstream so traffic is dropped at the connectivity provider
- FlowSpec (strict) — a targeted filtering rule instead of a blanket drop
- FlowSpec → RTBH — escalation when FlowSpec alone is not enough
- URL callback (webhook) — into your own systems
- SNMP trap and syslog — into your monitoring and SIEM
- Email plus an event in the console and the operator log
From a flow record to a blocked IP address
Automated threat detection
22 predefined rules in three families: floods against your addresses, floods from one of your hosts…
Automated threat detection
22 predefined rules in three families: floods against your addresses, floods from one of your hosts…
From an alert to an answer you can evidence
Every detected attack can be taken apart in depth — by its identifier, or by examining…
From an alert to an answer you can evidence
Every detected attack can be taken apart in depth — by its identifier, or by examining…
- Traffic Patterns — patterns that recur in your traffic
- Incident Simulation — rehearse how a response plays out before a real one arrives
- Stored forensic analyses with export
What people ask most
How quickly does it recognise an attack?
From a mirrored interface, within seconds. Records from IPFIX and NetFlow v9 exporters arrive 15 to 60 seconds after a connection ends, depending on your router configuration — the system evaluates those too and marks them as late, so you can tell what is happening now from what happened a moment ago.
Will it report attacks that are not really attacks?
Sensitivity is set with a single control across four levels — from high for quiet networks to very low for backbone and transit, where only a genuinely large attack should raise an alert. Each individual threshold can be tuned separately, and addresses that must never trigger a response go on a whitelist.
What if a detection is wrong and the system starts blocking?
For every response you set the severity at which it triggers. The whitelist also works granularly — per IP, port or protocol, and separately for the LAN and WAN side. Active blackholes sit in one table and any of them can be withdrawn with a single click.
Technical solution
The same platform, the same features, the same dashboard. All that differs is where the system runs and who owns the hardware. Learn more →
NIS2
The Czech Cybersecurity Act (No. 264/2025) applies to every ISP regardless of size. The system walks you through what it asks of you – from determining your regime to the final report. Learn more →
Flow monitoring
Collection from NetFlow v9, IPFIX and port mirroring, with context from the ASN database and global threat sources. All on the same data, on one screen. Learn more →
Data retention
You have to retain traffic and location data anyway. With us, data retention runs on the same data as monitoring and attack detection – one system instead of two. Learn more →
Pricing and SLA
A subscription sized to your network, hardware sized to the disk array, and clearly stated prices for SLA and data export. Learn more →
We show you the system on your network, not on a generic demo
Forty-five minutes, online, no commitment. We go through what the platform would look like at your organisation — how many systems it would replace, how NIS2 reporting would work for you, and what it would mean for your team. Walkthroughs are one-to-one, so the answers are specific rather than generic.