Locus NDR
Locus NDR (Network Detection & Response)
Sensor Deployment and Traffic Acquisition
Locus sensors receive traffic through network TAPs, switch SPAN or mirror ports, or virtual taps in cloud and virtualized environments, and can also be placed inline where active blocking is required. Sensors can be distributed across data centres, branch sites, and cloud segments, all reporting into the central platform, allowing both perimeter and internal segments to be monitored from a single management plane.
Locus NDR Key Features
Signature and anomaly-based detection.
A high-throughput engine evaluates traffic against a continuously updated threat ruleset while flagging protocol anomalies and deviations from normal communication patterns in real time.
Deep protocol parsing.
Native decoding of HTTP and HTTP/2, TLS, DNS, DHCP, SMB, QUIC, and more, exposing URIs, headers, methods, TLS SNI and ALPN, certificate details, and DNS query and response data to both detection logic and investigators.
Encrypted-traffic analysis
TLS and QUIC client and server fingerprinting (JA3, JA3S, and JA4) identifies malicious sessions and reused malware fingerprints without decryption, preserving privacy and performance.
File extraction and hashing.
Files transferred over the network are carved from the stream, typed, and hashed for malware lookup and evidentiary retention under policy control.
File extraction and hashing.
Files transferred over the network are carved from the stream, typed, and hashed for malware lookup and evidentiary retention under policy control.
Full-fidelity flow and session records.
Continuous connection and session metadata models normal behaviour and underpins command-and-control, beaconing, tunnelling, and data-exfiltration detection.
Locus NDR Benefits
Eliminates the network blind spot
Detects adversaries that never touch an instrumented endpoint, including unmanaged and OT/IoT devices.
Privacy-preserving detection
Encrypted-traffic fingerprinting identifies threats without breaking confidentiality or decrypting sessions.
Continuous asset discovery
Passively inventories everything talking on the network, exposing rogue and shadow devices as they appear.
Early lateral-movement containment
East-west visibility surfaces internal pivoting before an intruder reaches high-value systems.
Unified investigations
Network signals fuse with endpoint and identity evidence, so an analyst moves from alert to session to extracted file in one place.
Use Cases
Unmanaged, OT, and IoT visibility
Detect threats on devices that cannot host an agent, including industrial, medical, and building-automation equipment.
Command-and-control discovery
Reveal beaconing and covert channels used by malware and postexploitation frameworks, even over encrypted transport.
Shadow-IT and rogue-asset detection
Continuously inventory everything talking on the network and flag devices that should not be there.
Lateral-movement containment
Surface internal scanning and pivoting early, before an intruder reaches high-value systems.
Ready to take your business to new heights?
Get in touch, and let’s make it happen.
FAQs
1. What does Locus NDR do?
It monitors and analyses network traffic to detect threats across the perimeter and inside the network,
complementing endpoint-based detection.
2. How is Locus different from a firewall or IDS/IPS?
It combines signature, protocol-anomaly, and flow-based detection with encrypted-traffic fingerprinting
and file extraction, and can run as either an IDS or an IPS.
3. Does Locus need agents on devices?
No. Locus observes network traffic directly, so it sees unmanaged, IoT, and OT devices that cannot host an
agent.
4. Can it analyse encrypted traffic??
Yes. It fingerprints TLS and QUIC sessions (JA3/JA3S/JA4) to identify malicious activity without decrypting
the traffic.
5. How does Locus receive traffic?
Through network TAPs, SPAN/mirror ports, or virtual taps in cloud environments, and inline where active
blocking is required.
6. Can it block attacks, or only detect them?
Both. It runs passively as an IDS for detection and forensics, or inline as an IPS to drop malicious traffic.
7. How does it fit with the rest of the ecosystem?
Its structured telemetry is fused with endpoint and identity evidence in the shared correlation engine,
forming one coherent incident.
IT Performance and Security Solution Provider