Network detection & response
Most enterprise traffic is east-west, encrypted, and invisible to a firewall built to watch the edge. Guardian Sentinel's sensors read every conversation inside the estate, identify malicious behaviour in encrypted sessions without decrypting them, and block lateral movement at the hop where it starts.
Sensor placement
A sensor at the internet edge tells you about 32% of the picture. Sentinel places collection where the conversations actually happen: on core uplinks, between application tiers, inside cloud VPCs and on the branch links that terminate somewhere nobody has audited since 2019.
Scroll horizontally to see the full topology on a small screen.
East-west visibility
Once an adversary has a foothold, everything that matters happens between your own systems: enumeration, credential reuse, share mounting, database access, staging. Sentinel treats internal traffic as a first-class detection surface rather than an afterthought.
Sentinel learns which workloads legitimately talk to which, over what protocols, at what volumes and at what hours — per service, not per subnet.
Because the agent and the sensor share an entity graph, an SMB session is attributed to a named human or service account, not to an IP address that changed at lunchtime.
Full parsing for SMB, Kerberos, LDAP, RDP, DNS, HTTP, MySQL, PostgreSQL, MSSQL, SSH, RPC, NFS, Kafka and 68 more — including the odd ones OT networks rely on.
Sentinel shows what your segmentation policy actually permits versus what it intends, and flags every flow that crosses a boundary it should not.
Unmanaged devices are covered too. Printers, cameras, building management controllers, medical devices and contractor laptops cannot take an agent. The sensor profiles them passively, assigns a device class and behavioural baseline, and alerts when a thermostat starts speaking LDAP.
Encrypted traffic analysis
TLS interception is expensive, fragile, blocked by certificate pinning, hostile to privacy regulation and increasingly defeated by encrypted client hello. Sentinel identifies malicious sessions from their observable shape instead — fingerprints, cadence, size sequences and directionality.
Scroll horizontally to see the full chart on a small screen.
Lateral movement
Breakout time — the interval between initial access and the first lateral hop — fell to 41 minutes in 2026. Sentinel scores the path an attacker is building as it forms, and blocks the next hop rather than reporting the last one.
Scroll horizontally to see the full attack path on a small screen.
Deployment
Most estates use three of these at once. Sensors self-register to the tenant, pull policy automatically and require no local storage or management interface of their own.
| Form factor | Typical placement | Traffic source | Sustained throughput | Inline blocking |
|---|---|---|---|---|
| Virtual sensor | Data centre core, DMZ, SD-WAN hub | SPAN, ERSPAN, VXLAN mirror | Up to 10 Gbps | Via firewall or NAC integration |
| Hardware appliance GN-4200 | Campus core, medium data centre | Optical or copper TAP, SPAN | 20 Gbps | Yes, fail-open bypass pairs |
| Hardware appliance GN-8800 | Large data centre, internet edge | Optical TAP, packet broker | 40 Gbps | Yes, fail-open bypass pairs |
| Cloud mirror sensor | AWS, Azure and Google Cloud VPCs | VPC traffic mirroring, vTAP | Up to 8 Gbps per instance | Via security group or NSG update |
| Container sensor | Kubernetes clusters, service mesh | eBPF on each node, DaemonSet | Node line rate | Yes, via network policy |
| Agent-derived flow | Anywhere an endpoint agent already runs | Host socket telemetry, no mirror needed | N/A | Yes, host firewall |
Scroll the table horizontally to see every column.
Sensors carry no persistent traffic storage by default. Optional rolling packet capture is written encrypted to local disk and released only on an authorised investigation.
Sentinel pushes containment through the controls you own: Palo Alto, Fortinet, Cisco and Check Point firewalls, Cisco ISE and Aruba ClearPass for NAC, plus native security groups, NSGs and Kubernetes network policy.
Inline sensors ship with hardware bypass pairs. Power loss, software fault or an upgrade never becomes a network outage — traffic passes and the sensor rejoins when it is healthy.
The observed communication map becomes a proposed segmentation policy you can review, simulate against 30 days of real traffic and export directly to your enforcement point.
Network questions
Not for managed hosts — agent-derived flow gives you attributed socket-level visibility with no mirror infrastructure. Sensors matter for what cannot take an agent: appliances, printers, cameras, OT controllers, medical devices, contractor and BYOD endpoints, and any segment where you want inline blocking independent of the host.
Metadata-only operation, which is the default, uses roughly 0.4% of inspected volume. Triggered capture writes only the sessions surrounding a detection, typically 2–6 GB per incident. Continuous capture is available and sized at approximately 430 GB per gigabit per day if you need it for regulatory reasons.
Measured added latency is under 90 microseconds at 40 Gbps for the GN-8800. Most customers start in TAP or SPAN mode with enforcement delegated to an existing firewall, and move to inline only for specific high-risk segments.
In most displacements, yes — and the consolidation usually reduces appliance count because agent-derived flow eliminates sensors that existed only to watch managed servers. Guardian will map your current sensor estate to a proposed Sentinel design during evaluation, including a like-for-like coverage comparison.
Passively. The sensor is deployed off a TAP with no transmit path into the OT segment, parses Modbus, DNP3, S7comm, EtherNet/IP and BACnet, and never actively scans. Detection and asset inventory are read-only; enforcement, if any, happens at the IT/OT boundary. See energy & utilities for reference designs.
Remote workers going straight to SaaS, and cloud-to-cloud traffic, are covered by the endpoint agent and by cloud security respectively. That is the point of a single data layer — the network module is one contributor to a picture that does not depend on traffic being backhauled anywhere.
We had east-west blindness we could not price. Six weeks after the sensors went in, Sentinel showed us 1,400 flows crossing a segmentation boundary we believed had been enforced since 2021. That finding alone paid for the programme.
A two-week visibility assessment with a virtual sensor on one core uplink. No agents, no inline change, and a written findings report at the end whether or not you proceed.