Telemetry as a Service
Visibility into what your network is actually doing — traffic behaviour, protocol detail, anomalies — without handing your logs to a third party or opening a hole in your perimeter to get them out.
What sits on your network
A small, low-power appliance on the segments that matter, running a hardened rootless Podman runtime. It inspects traffic locally. It does not listen for connections, and it does not need a route back in.
Language models, kept in-house
The useful part of applying a model to telemetry is summarisation. The risky part is where the model runs. Ours runs on your side of the boundary.
Models on your hardware
Analysis runs on local Ollama engines against open models, inside your cluster. Nothing is sent to a hosted model API, so there is no question about what a vendor might retain or train on.
Triage instead of raw volume
Nobody reads a million log lines. Automated triage summarises what the node saw overnight and says what to look at first, with the underlying events one click away when you want them.
A switch you control
The AI analysis can be turned off entirely with a config change — useful when an auditor asks what processes your data, and you want the answer to be "nothing does."
Your own tenant, not a shared index
Vector ships the compressed stream over a Headscale or Tailscale tunnel into Graylog, OpenSearch, and Prometheus instances that are yours. Separate clusters, not a shared pool with a filter on top.
We notice when the node changes
A background check hashes the node's critical configuration every 15 minutes against a known baseline. If something changed and no one filed a change for it, that becomes an alert rather than a discovery three months later.
Not sure your network is ready for a node?
Four questions decide it — mirror port capacity, outbound policy, management segmentation, and flow export. The checklist walks through each one.