THE PIPELINE
From Raw Traffic to a Real Answer
Most NIDS tools stop at flagging that something looks wrong. Here's exactly what happens between an upload and a finished incident report.
1. Upload
Drop in a CICFlowMeter-formatted CSV export of your network flows — up to 2MB or 2,000 rows per upload.
2. Detect
A 4-model ML ensemble (Random Forest, XGBoost, LightGBM, and a stacking meta-learner) scores every flow across 13 attack categories, with calibrated confidence — not just a raw softmax score.
3. Understand
For the highest-confidence threats, an AI agent reads the classification plus any available attribution context and writes a clear WHAT / WHERE / HOW / WHY report — grounded in a retrieval step so it explains and cites, never invents.
4. Act
Every flagged flow gets a severity level, a recommended action, and an urgency rating — the same judgment call a security analyst would make, ready to export as a PDF.