Trisul Network Analytics

Trisul Network Analytics, developed by Unleash Networks, is a solution designed for deep network monitoring. It caters to small to large enterprises, providing network security and performance monitoring capabilities. This product is utilized by network security analysts, IT administrators, network engineers, internet service providers (ISPs), and telecom companies across various industries.

Key Features

Tight solution: According to the vendor, Trisul Network Analytics offers a tightly integrated backend datastore and a web UI. It provides the flexibility to plug into different backends or drive Kibana and Grafana UIs.

Use packets: The vendor claims that Trisul efficiently stores only the necessary data with its powerful packet storage capabilities. It employs sophisticated methods to optimize storage requirements.

Scale out: Trisul is designed to maximize performance in a single node. For larger networks, the vendor suggests that scalability can be achieved by adding more probes and hubs.

Reconstruct: In addition to capturing traffic and flows, Trisul utilizes metadata, objects, resources (such as TLS Certs and files), IDS alerts, and more. According to the vendor, this comprehensive approach enables users to complete tasks effectively.

Network Security Monitoring: Trisul simplifies network security monitoring by collecting metrics, flows, alerts, documents, and encryption metadata. It indexes and links data down to raw packets, providing confidence in monitoring, detecting, responding to, or investigating any network activity.

Built-in IDS and threat integration: Trisul includes built-in IDS and threat integration, enabling users to track and receive alerts on over 200 traffic metrics. It seamlessly integrates with mirror ports or TAPs, supporting speeds up to 40Gbps and monitoring all flows, packets, and objects.

Hundreds of metrics for millions of entities: Trisul offers built-in algorithms, including Top-K, Bottom-K, Cardinality, and First-seen. These algorithms facilitate retrospective analysis for incident response. The system can ingest packets, netflows, SNMP, or logs, providing extensive metrics for millions of entities.

Ingest Netflows or reconstruct flows from packets: Trisul supports the ingestion of Netflows or the reconstruction of flows from packets. It offers a flexible query language and Flow Taggers to add searchable text labels to flow records, without any summarization or rollups.

Packet storage and recall: Trisul continuously saves raw packets for future analysis, allowing users to recall them as needed. It optimizes packet storage requirements and streamlines PCAP drilldown workflows for efficient network security monitoring.

Trisul Netflow Analytics: Trisul provides full visibility and analysis of network traffic and flows, supporting all versions of Netflow, SFlow, JFlow, IPFIX, and NetStream. It offers device and interface drilldowns for detailed insights into network behavior.