Your perimeter is watched. Your internal network isn't. Intrudect surfaces the reconnaissance, lateral movement, and outbound paths that firewalls and endpoint tools can miss. It runs entirely on your own infrastructure.
Agents collect metadata and raise alerts in your environment. You do triage, investigation and configuration in a single central Web UI.
Passive SPAN analysis: port, ARP and DNS scans, lateral movement, DNS tunnelling and C2, rogue DHCP/DNS, unauthorized services, Suricata rules, and IOC matching against aggregated threat feeds.
Decoy TCP/UDP services on chosen IPs and ports, emulating real protocols from SSH to SMB. Detects SYN and connect scans. Any contact is a high-signal alert, with a full session PCAP. Beacon documents extend the tripwire to data: unique decoy files generated in the UI that call back when opened, also after they leave your network.
Runs 24/7 and tries to reach the outside from segments that should be isolated: DNS, IPv4/IPv6, ICMP, proxy abuse. The alert shows which segment leaked and by which method.
Regex monitoring across syslog, web, database and audit logs. SQL-injection patterns, unexpected password logins, decoy-file access. You set the rules and severities.
Alert triage, search and dashboards, per-agent configuration, LDAP/AD login, MFA (TOTP + YubiKey), role-based access and a full audit log. Route alerts by weekday, work hours, category and priority to Slack, Teams, Discord, e-mail, or JSON export into Elastic, Wazuh and Security Onion. Optional automated blocking on MikroTik and FortiGate firewalls, and a public REST API for search, export and automation.
So far, every deployment has surfaced something the client didn't know was there.
Inter-network flows between segments the client believed were isolated. The flows had run for months before anyone looked.
Hosts still connecting to long-deprecated endpoints: dead services and forgotten integrations.
Public endpoints forwarded straight into the workstation LAN instead of a DMZ. The network diagrams did not show it.
No feature tiers: every agent ships with its full detection capability, and the Web UI and all integrations are in every plan. Tiers differ in which agents, and how many, they include.
Partner and volume pricing, multi-site and SaaS-capable, with central remote updates across every deployment.
Deploy on your own hardware and see what Intrudect surfaces on day one.