Packet observation
Traffic visible to the Node
Observe communication directly on a host or from a mirrored network feed. Produce flow telemetry and protocol evidence from the traffic at that vantage point.
Prophet Node
Network observation,
in your infrastructure.
Prophet Node is the runtime of Prophet’s distributed observation layer. Deploy it where traffic is visible. Choose what it collects. Manage the fleet centrally.
Selected console views, not an installation recording. Throughput is flow telemetry, not a packet-processing benchmark.
Deployment follows
your infrastructure.
Instrument the workloads you choose. Add existing network exports or mirrored traffic where they extend coverage. A TAP or mirror is an option, not a requirement for observing an instrumented host.
- AServers & virtual machines
- Install on selected hosts in your data center or cloud account, including sensitive servers that need direct visibility.
- BContainers & Kubernetes
- Use a container deployment or the Helm chart. The DaemonSet places a Node on each eligible cluster host.
- CExports & mirrored traffic
- Receive flow exports from network devices, or observe traffic delivered to a capture interface on an existing host.
- DProphet infrastructure
- Prophet operates observation reconciliation, storage, communication modeling, detection, and investigation.
One generated command.
A shared collection profile.
Choose the deployment method and a prepared profile in the console. Run the generated command, approve the Node, and manage its settings from the same place.
For Kubernetes, Helm applies the deployment across current and newly added eligible hosts. Profiles let those Nodes share collection settings without configuring each host separately.
One runtime.
Several collection roles.
A Node can run multiple roles together. Select the evidence appropriate for that location; available collection depends on the platform and configuration.
Flow exports
NetFlow, IPFIX, and sFlow
Receive exports from network devices and existing infrastructure. Extend coverage to places where installing a Node directly is not practical.
Host evidence
System and authentication logs
Collect configured logs on supported hosts. Prophet correlates this evidence during investigation to help establish who acted and what happened on the machine.
Suricata log forwarding
An existing Suricata deployment
Forward EVE JSON from Suricata you already operate. This is a log collection role; the Node does not deploy or run a Suricata IDS.
You choose the coverage. Prophet brings the observations together.
Prophet reconciles network observations across sources and vantage points into a coherent view of communication. Configured host evidence helps explain who acted and what happened during investigation. Available detail depends on each source.
Observe locally.
Operate centrally.
The Node handles observation at the edge. Prophet operates the storage, modeling, and investigation infrastructure behind it.
Designed for production hosts
Nodes produce compact network telemetry near the source. The central analysis infrastructure does not need to run on each host.
Resource requirements depend on traffic volume, enabled roles, and capture settings. Validate the footprint on representative workloads before broad deployment.
A fleet, not a set of separate installs
Review control and ingest connectivity, flow-telemetry throughput, configuration, and software versions from the console. Apply shared collection profiles and manage software update settings centrally.
Prophet Agent can help you navigate deployment and inspect the fleet. Registration approval and deployment decisions remain yours.
Before you deploy.
Access, coverage, and data boundaries.
What happens after I run the install command?
The Node registers with Prophet. Approve the registration and apply the collection settings you want. A prepared profile supplies shared settings; without a profile, collection services start disabled until you enable and deploy them.
Where should I put a Node?
Start where the communication you need to observe is visible: selected servers, virtual machines, cluster hosts, or a host receiving mirrored traffic. A Node observes its own vantage point. One installation does not automatically see the rest of your network.
What access does it need?
Packet capture and some host evidence require elevated access. Container and Kubernetes deployment options request the host visibility and capabilities those roles need. Review the generated deployment and enable only the collection roles appropriate for that environment.
What network access is required?
Nodes connect outbound over TLS to Prophet’s control and ingest services. Installation also needs access to the relevant package or container source. If you enable flow-export collection, exporters must be able to reach the Node’s UDP listeners.
What data leaves the environment?
Nodes send network telemetry and the host evidence you configure to Prophet infrastructure. Payload extraction is optional and disabled by default. Review collection settings against your data requirements before enabling a role.
Does a Node block traffic or manage the host?
No. Prophet Node observes. It does not block traffic, quarantine machines, or replace host management. Prophet performs detection and investigation centrally using the observations your deployment provides.
Start with the hosts
you need to observe.
Deploy Nodes in your environment. Prophet operates the infrastructure behind them.