Network telemetry
Anomaly detection console
Capture synthetic network flows and surface anomalous behaviour using a robust statistical scorer (median + MAD + rule-based boosters). High fan-out, large byte-rates, and traffic to audited ports from non-RFC1918 source IPs trigger severity flags.
Seed sample traffic
Generates ~80 synthetic flows: a benign baseline, a port-scanner pattern, and a handful of high/critical anomalies. Use this to populate the dashboard without needing an external feed.
Distribution
- ~60 benign baseline flows · RFC1918 sources · common ports
- ~12 scanner flows · single non-RFC1918 srcIp · many distinct dsts
- ~6 high flows · large bytesPerMs · non-RFC1918 dst
- ~2 critical flows · audited dstPort (22 / 3389) · non-RFC1918 srcIp