Skip to content
TALON/01Open watch
00 / INGESTNETWORK INTELLIGENCESCROLL TO TRACE ↓

TALON

MAKE THE SIGNAL LEGIBLE.

Raw traffic is not evidence.
Talon follows the packet until a human can question the decision.

Enter the stream
01 / PARSEPACKET → FLOWBOUNDS CHECKED
RAW→FLOW
SOURCEDESTINATIONPROTOBYTESSTATE
10.0.0.24172.16.4.9TCP52SYN_SENT
192.168.1.11210.0.0.7TCP148ESTABLISHED
172.16.0.210.0.0.14UDP380OBSERVED
10.0.0.91185.220.101.4TCP824FLAGGED

The noise aligns. A bounded C++ parser turns packet structure into flow evidence that downstream decisions can retain.

02 / DECIDEHELD-OUT EVALUATIONNO SYNTHETIC CLAIMS

THE MODEL MUST
SURVIVE THE NEXT
QUESTION.

Measured on 10,000 held-out flows. The page reports the stored evaluation, not a live production promise.
TEST FLOWS10,000held out
ATTACK RECALL98.94%measured
ACCURACY86.09%random forest
03 / TRACEONE EVIDENCE PATHWIRE → ANALYST

FOLLOW
THE WHOLE
PATH.

Each handoff remains visible. Capture, features, verdict, and enrichment resolve into the same analyst surface.

01CAPTUREXDP / C++
02FEATURESFLOW DERIVATION
03DECISIONRANDOM FOREST
04CONTEXTIOC ENRICHMENT
05SURFACEFASTAPI / NEXT.JS
04 / MEASURESEVEN NATIVE RUNSEQUIVALENT RATE
THE COST
OF SEEING1.77×
C++ PARSER9.05M/s
XDP PATH16.05M/s
42.6% LOWER

per-packet processing cost

Equivalent throughput derived from seven native XDP benchmark runs. This is not a sustained end-to-end replay measurement.
05 / WATCHTHE SIGNAL RESOLVESHUMAN IN THE LOOP
12:41:07185.220.101.4──────HIGH / 0.94IOC MATCH

ONE TRACE.
ENOUGH CONTEXT
TO ACT.

Open the analyst surface. Inspect live flows, model evidence, and known-bad context without losing the path that produced them.

ENTER TALON / WATCH