Intelligence, automation
and tooling — built in.

Turn a detection into a block. The moment something is confirmed malicious, NIKSUN acts across every layer — on the endpoint, on the network, and at the domain — pushing the block to the enforcement points you already run and verifying it in the lake. Every action is triggered by correlated evidence and provable after the fact.

• ✓Block a confirmed-malicious host across firewalls, CDNs, & cloud security groups
• ✓View & manage all your firewall policies from one console
• ✓On-host blocking + Zero-Trust segmentation, air-gap capable — no third-party EDR required
• ✓Domain blocking for known-bad & disallowed destinations — with allow / deny lists & category policy
• ✓Triggered by correlated evidence — threat intel, detections, & Maya
• ✓Reaches the tools you already run through 500+ Connectors — no rip-and-replace
• ✓Verified in the lake — every block is re-checked and provable, not fire-and-forget

Every incident gets a home. Track, assign, and collaborate end-to-end — with the evidence, AI analysis, and remediation history attached automatically. No copy-pasting between a SIEM, a ticketing tool, and a spreadsheet.

• ✓Auto-created from incidents, with full evidence attached
• ✓Assign, comment, and collaborate across the team
• ✓Complete audit trail for compliance & post-mortems
• ✓One source of truth from detection to resolution

A single lightweight agent that collects data from anywhere — endpoints, servers, remote sites, and cloud — and feeds it into the lake. NetTrident also acts: quarantine a device, kill a process, or enforce compliance, right from the platform.

• ✓Collects from endpoints, servers, OT, and cloud workloads
• ✓Streams deep endpoint activity — processes, users, exploits, compliance violations, system health, & more — into the NKW
• ✓Endpoint Protection: centralized host-based policies, reusable across agents
• ✓Zero Trust segmentation: define zones & microsegments and block cross-zone traffic on the host — software air-gaps
• ✓Auto-quarantine compromised endpoints on intrusion or compliance violation
• ✓Transactions to test networks, VoIP, & infrastructure
• ✓Runs on Windows, macOS, Linux (Debian, Ubuntu, & more), FreeBSD — or a NikOS appliance
• ✓Remote packet capture from sites without 24/7 FPC — captured to NetBin
• ✓Drives EDR-style action through Playbooks
• ✓Powers endpoint protection & blocking — deep endpoint insight, correlated with the network, drives response right on the host

Proactively test your infrastructure before users feel the pain — network & path tests for latency, RTT, loss, and hop-by-hop routing, plus DNS, SIP, and more. The difference: every result lands in the NKW, correlated with the CPU, memory, processes, and packets of the systems on both ends.

• ✓Network/path tests — latency, RTT, loss, & full hop analysis
• ✓DNS, SIP, and service tests from any vantage point
• ✓Results correlate with real metrics, traces, & packets — not a siloed score
• ✓Maya can launch tests on demand or agentically

A live feed of threat indicators (threats), built into the platform. Look at any IP, domain, hash, or other field and ThreatStream tells you what threats it's associated with — and which co-occurring indicators, if you also see them, mean those threats are live in your environment right now.

• ✓Live threat feed — IPs, domains, hashes, URLs, & more
• ✓Instantly see the threats any field is associated with
• ✓Correlates co-occurring indicators to confirm a live threat
• ✓Runs against the full NKW — alarms the moment a match appears

Get your team up to speed fast. Courses are out-of-the-box trainings covering core IT and security concepts — and how to get the most out of NIKSUN — so analysts ramp quickly and grow into the platform.

• ✓Foundations of network security, forensics, & performance
• ✓Hands-on NIKSUN operation, from search to remediation
• ✓Self-paced tracks with progress & certification
• ✓Onboard new analysts in days, not months