Drops into your existing Suricata deployment

Integrates with your SIEM, SOAR, and ticketing systems through n8n

MQTT event bus connects to anything in your stack

Deploys on any commodity hardware — no proprietary appliances

Air-gap ready: fully disconnected operation, no cloud required

No recurring subscription. No SaaS to kiss.

Suricata integration with full EVE JSON enrichment

Unsupervised ML for signature-free anomaly detection

Encrypted traffic analysis via JA3/JA4 fingerprinting

AI-ready: query network data conversationally via MCP server

AI-assisted Suricata rule injection on detection

Workflow orchestration with n8n for custom response playbooks

SIEM/SOAR forwarding with fluentbit to Splunk, Sentinel, Shuffle

MQTT event bus for real-time alert distribution

Full metadata capture including enriched flow.

Arrow Parquet for fast analytical queries at scale.

Store local or push to S3-compatible storage.

Meet regulatory and audit requirements with immutable storage.

Analyze historical data with any Parquet compatible engine.

Capture — Suricata passively monitors your network via TAP/SPAN, feeding traffic to Rockfish.

Detect — Rockfish's behavioral engine analyzes enriched metadata to identify lateral movement, C2 beacons, data exfiltration, and anomalies that signatures miss.

Respond — Detection events fire over MQTT to n8n, triggering automated playbooks.

Archive — Every flow is enriched and stored in immutable Parquet format.