# Webscout Observability Platform

> Sovereign NDR and network intelligence. Search Zeek logs, PCAP and flows with VPN, Tor and proxy context on every IP. Cloud, on-premises or air-gapped.

## Webscout Observability Platform

The hub for <span class=ws-nowrap>full-stack</span> network detection, response and intelligence. Your telemetry, Webscout's covert network traffic, or both, side by side in one interface.

[Request a demo](#access)

[See the platform](#inside)

## Search, investigate and <mark>respond</mark> in one interface

Lookups for every IP, domain and JA4+ fingerprint, dashboards over your events, and signals curated from published threat reporting, with their hits in your data.

## Start with your telemetry, <mark>extend it with ours</mark>

Connect what you already run, and add Webscout's enrichments and covert network traffic where you need more. Everything sits side by side in the same searches.

- [**Your telemetry and enrichments**](#access) — Connect your own sources and the enrichments of your choice. The platform contextualises, correlates and searches them in one place.

- [**Webscout’s enrichments and covert traffic**](solutions/intelligence/covert-network-flows/) — Batteries included. Webscout's proprietary enrichments on every IP, and covert network traffic as an extension of what your sensors see.

## From the alert to the investigation behind it

- **High-speed search** — Lucene queries across connection, DNS, HTTP and other log types, with a time histogram and log-type distribution for every query.

- [**Automatic contextualisation**](solutions/datasets/vpn-proxy-detection/) — Every IP in context, from geolocation and network ownership to VPN, Tor and residential proxy attribution, in every search, lookup and investigation.

- **Aggregate and correlate** — Top values, unique counts, significant terms and histograms, without pulling the underlying events.

- **Pivot on any selector** — Move across related infrastructure from an IP, domain, URL, JA4+ fingerprint, hash, email, ASN or country.

- **Dashboards and signals** — Live views over your events and curated network signals, for alerting and detection.

- **Results where you need them** — Stream results and aggregations to JSONL or CSV, or pull them over the API into your SIEM or MISP.

## Detection, response and intelligence, <mark>in one place</mark>

- **Threat hunting** — Start from a JA4+ fingerprint, an ASN or a residential proxy provider and see every matching connection across your connection, DNS, HTTP and other logs, then pivot from there.

- **Incident response and network forensics** — Reconstruct an incident from the network record: which hosts talked to which infrastructure, when, and through which anonymising service, from the Zeek logs, PCAP and flows you already collect.

- **Detection engineering** — Turn findings into custom rulesets and alerts, and watch signals curated from published threat reporting hit your own data.

- **NDR and SIEM work in one interface** — Detection on your network telemetry and high-speed search, correlation and dashboards across your logs, so analysts detect, investigate and respond in the same place.

## Run it where your mission requires

- [**Cloud**](https://app.webscout.io/) — Operated by Webscout in a sovereign European cloud and reached from your browser.

- [**On-premises**](#access) — Sovereign deployment on your premises, so sensitive network data and investigative workflows stay within your environment.

## Questions about the <mark>platform</mark>

- **Can I bring my existing Zeek logs, PCAP and flows?** — Yes. Connect your own network telemetry, such as Zeek logs, cloud logs, PCAP, web logs and firewall flows, plus partner feeds, lawful intercept data and third-party enrichments through APIs and data feeds. Webscout's covert network flows, honeypot flows and enrichments sit beside them in the same searches.

- **How is it different from a network detection and response (NDR) tool?** — On your own networks it works like an NDR, with every connection in context. It then adds what your sensors cannot see: Webscout's covert network traffic from Tor, residential proxies and ORB networks, and VPN, Tor and residential proxy attribution for every IP address.

- **Does it replace a SIEM?** — It brings NDR- and SIEM-class capability into one interface: detection on your network telemetry, and high-speed search, correlation and dashboards across your logs. It can also run beside an existing SIEM, with results and aggregations sent there over the REST API or as JSONL or CSV.

- **How are VPN, Tor and residential proxy connections identified?** — Every IP address in every event is matched against Webscout's [anonymisation dataset](/solutions/datasets/vpn-proxy-detection/), which names the VPN or proxy provider behind it, or marks it as a Tor relay, with the kind of pool and when it was seen. Geolocation and network ownership are added the same way.

- **How does it handle encrypted traffic?** — Through JA4+ fingerprints, which characterise the client and server software from the TLS handshake, and from HTTP, SSH and TCP. Encrypted sessions can be grouped, searched and pivoted on without decrypting them.

- **Can it run on-premises or air-gapped?** — Yes. Use the cloud version, operated by Webscout in a sovereign European cloud, or run it on your premises: containerised and standalone, with local ingestion of your own telemetry. Air-gapped deployments are available for select partners in high-side environments. See [air-gapped network analysis](/guides/air-gapped-network-analysis/).

- **Where is our data held?** — In the cloud version, in a sovereign European cloud operated by Webscout, with access per vetted organisation. On premises, in your own environment: sensitive network data and investigative workflows stay there.

- **How do analysts search and investigate?** — With high-speed Lucene search across connection, DNS, HTTP and other log types, aggregations such as top values, unique counts and significant terms, and pivots on any selector: IP address, domain, URL, JA4+ fingerprint, hash, email, ASN or country. See [threat hunting in Zeek logs](/guides/zeek-threat-hunting/).

- **Does it support JA4+ fingerprints?** — Natively. JA4+ fingerprints are carried on flows and can be searched and pivoted on, and [JA4DB](/solutions/platform/ja4db/), built on the platform, returns the context behind any fingerprint. See [JA4+ fingerprints explained](/guides/ja4-fingerprints-explained/).

- **Can results go to our SIEM or MISP?** — Yes. Stream results and aggregations to JSONL or CSV, or pull them over the REST API into your SIEM, MISP or other tools.

- **Who can use the platform?** — Webscout works exclusively with vetted partners in government, defence, intelligence and critical infrastructure. Contact info@webscout.io to learn more.

## Extend what the platform sees

## Webscout works exclusively with vetted partners in government, defence, intelligence and critical infrastructure.

Contact info@webscout.io to learn more.

[Email us](mailto:info@webscout.io?subject=Demo%20request%3A%20Webscout%20Observability%20Platform)

[Book a call](https://calendar.app.google/vs5JkoxAcN336RA68)