SMART · STREAMING METADATA ANALYTICS IN REAL TIME
Pre-release. Free evaluations now open.
SMART finds what the firewall and IDS miss.
A firewall judges each session in isolation. SMART judges it against the entire enterprise history, kept in an in-memory graph of every client-server association, so every decision is made in context. Logs are processed faster than the firewall can produce them, and analysts get prioritized leads in real time.
TWO MODELS FOR BEHAVIORAL ANALYTICS
Archive everything, or remember what matters.
The Archive model
Stream every log to a disk archive and index it on the way in. Targeted analytics run later, out of the archive. Well suited to looking things up, but behavioral analytics across all of history is too much processing for a disk archive.
The Memory model
Maintain aggregated data in a graph using extreme lossy compression. The result is orders of magnitude smaller, yet preserves what behavioral analytics needs, so the whole enterprise network model fits in RAM on commodity hardware.
HOLISTIC NETWORK INTELLIGENCE
The next step after 30 years of firewalls.
Stateful inspection and next-generation firewalls were sound incremental improvements. Holistic Network Intelligence widens the view from a single client-server session to its full historical context.
Stateful firewall
Tracks the state of each connection.
Next-generation firewall
Moves up the stack to inspect applications, still one session at a time.
Holistic Network Intelligence
Judges every client-server association against all of its history and everything related to it.
SMART decides from a flowset: the full Holistic Network Intelligence context around the same session.
SMART keeps all of this history in an in-memory graph and follows the touch-data-once principle: no disk archive is needed. That makes real-time detection possible, and gives the cyber hunter prioritized leads with the ability to explore the historical sessions behind them.
CAPABILITIES
Built to be fast, historical and in context.
Real-time processing
Runs faster than real time in environments of up to a million endpoints.
Historical awareness
Holds months, up to a year or more, of metadata for real-time, near-real-time and historical analytics.
Touch data once
Streaming metadata is processed a single time, for maximum efficiency and minimal overhead.
Feature extraction
Lossy compression models for every client-server association, with volumetric and temporal features kept as histograms.
In-memory computation
No data warehouse: the entire network model of the enterprise fits in RAM.
Machine learning
Behavioral models such as Random Forests, updated from in-memory features without going back to the original data.
Contextual analysis
Connections and DNS activity are correlated across the enterprise, so decisions come from sets of associations, not single connections.
Cyber hunting tools
Web and scripting interfaces to explore and investigate the leads the analytics generate and prioritize.
ANALYTICS
From flowsets to a convincing argument.
A flowset gathers dozens of related client-server associations, spanning hundreds to thousands of sessions. SMART scores them all and hands only the strongest leads to an analyst, with the evidence written out.
Related sessions involving the client, the server or shared features are grouped into flowsets.
Many indicators of compromise are computed independently from graph-based features within each flowset.
A classifier scores many millions of flowsets for malicious activity.
A ranked list of thousands of survivors moves forward.
An LLM expands the evidence and builds the case. Each flowset is only a few thousand tokens, so this step is inexpensive.
FOR THE AI SOC
The token-lite front end an AI SOC needs.
AI agents in the SOC are only as good, and only as affordable, as what they are fed. Point an LLM at raw logs and you pay to read every line, while the history that matters rarely fits in the context window. SMART does the heavy lifting in memory first, so the model reasons over a few compact, pre-ranked leads instead of a firehose.
Token-lite by design
Each flowset condenses dozens of associations and thousands of sessions into a few thousand tokens of structured evidence, not raw log lines.
Only the leads that matter
Millions of flowsets are scored cheaply in memory. Only a ranked list of thousands of survivors ever reaches the LLM.
Context already assembled
History, related clients and servers, DNS and protocols arrive together in one prompt. The agent explains a lead instead of hunting through an archive for one.
Analyst-ready output
The LLM expands the evidence and writes a convincing argument for each lead, ready for a human analyst or the next AI agent in the workflow.
| Measure | LLM on raw logs | LLM on SMART flowsets |
|---|---|---|
| Token cost | Grows with log volume | Grows with ranked leads, a few thousand tokens each |
| History | Limited by the context window | Months or more, already summarized in the graph |
| The model's job | Find the needle | Explain a lead that has already been found |
DEPLOYMENT
Designed to run alongside your existing tools.
Network-based and host-based intrusion detection complement each other. SMART adds an independent layer beside them: it reads the same firewall, router, proxy and DNS logs your SIEM already collects, and keeps an in-memory history of every client-server connection. It can take those logs in real time from the exporters, or replay history directly from your SIEM. It does not depend on IDS alerts, so it can find what they miss.
COMPARE
How the SMART approach differs.
| SMART graph | Existing solutions |
|---|---|
| Retains essential metadata | Retain full metadata |
| In-memory graph | Large disk archive |
| Behavior based | Signature based |
| Streaming analytics built in | Streaming analytics layered on |
| Batched analytics examine the graph | Batched analytics must trawl the archive |
| Detects structural properties of the network | Detect specific properties of data |
EVALUATION PARTNERS
Evaluate SMART on your own network.
SMART is the result of ongoing research and development and is not yet for sale. We are inviting a small number of organizations to evaluate it on real traffic, at no cost. What we learn together shapes the product before it is released.
What you provide
- Firewall, router or proxy logs, and DNS logs, streamed in real time or replayed from your existing SIEM. These are the only inputs SMART reads.
- A technical contact who can answer questions about your network.
- Your judgment on the leads SMART surfaces: which were useful, and which were not.
What you get
- A retrospective analysis of the last 90 days, replayed from your SIEM, so results arrive without waiting for new traffic.
- Prioritized leads drawn from your own logs, each with the evidence behind it.
- A view of activity your current firewall and IDS may be missing.
- Early influence over features and integrations.
- No charge for the evaluation.
Details such as the length of the evaluation and where SMART runs are agreed with each partner.
Become an evaluation partner.
Leave your work email and organization, and we will follow up to talk about fit.
Thank you. We will follow up about the evaluation.