Consolidated network services · appliance or VM
Rover Datum
A datum is the fixed reference everything else is measured from. Rover Datum is that for a site's network: one platform carrying the services a network needs in order to work and to be governed. Virtual routing, addressing, name resolution with threat-intelligence filtering, wide-area connectivity, and the collection that feeds your monitoring. Sized to the site, and the same platform whether it lands in a comms room, a data centre, or a hypervisor.
What it carries
A set of functions, declared per box, on one platform to patch and audit
An appliance is not a product tier. You declare which functions a box serves and it serves them, so the same platform is a branch router at one site and a hypervisor quorum member at another. The list below is what ships today and it grows; a function you need that is not here is a conversation rather than a different product.
Virtual routers
Multiple independent routing instances on one platform, so separating tenants, enclaves or classifications is a configuration change rather than another box and another maintenance window.
DHCP server
Addressing across every segment the site runs, held next to the resolver that answers for those addresses rather than in a separate system that drifts out of step with it.
Secure DNS recursor
Resolution with response policy zones fed by threat intelligence. A domain that turns malicious stops resolving site-wide on the next update, without anyone writing a firewall rule.
SD-WAN
Multi-path wide-area connectivity across the circuits the site actually has, with failover handled on the platform instead of by a separate appliance in the path.
SIEM collection
Collectors gathering logs and events from the site and forwarding them to your monitoring, so a remote site arrives in the SIEM as a source rather than as a gap.
Shell rendezvous
A meeting point for shell access to kit behind the site's edge, so an engineer reaches a device without that device holding an inbound rule or a public address.
Wireless controller
The controller for the site's access points, on the same box that already runs its addressing and resolution, rather than as a separate appliance or a cloud tenancy.
Stealth node gateway
The site's entry point for transports that have to be unremarkable to anything inspecting the path. Where ordinary tunnels are blocked or fingerprinted, this is what the site comes up on.
Overlay lighthouse
The rendezvous that lets overlay members find each other and establish direct paths, so a site is reachable without every node needing a fixed public address.
Proxmox quorum node
A quorum member for a site's hypervisor cluster, which is often the third vote a two-host cluster needs. One small appliance instead of a third server bought to hold an election.
The console
One view of every appliance, wherever it sits
Datum appliances report to a single console whether they are in a rack, a comms room or a hosted VM. The screens below are the working interface, with site names, hostnames and identifiers replaced.
Screenshots from a working console. Organisation, site names, host aliases, build identifiers and map locations are illustrative.
One platform, three placements
Where it runs
- On premise
- A site appliance, sized from a small remote office upward
- Data centre
- Rack-mounted, sized for aggregation and higher throughput
- Hosted
- As a virtual machine in a VPS or cloud environment
- Consistency
- Same services, same configuration model, same evidence wherever it lands
Sizing
- Range
- A family of sizes rather than one box with options
- What changes
- Capacity: throughput, interface count, storage for collection
- What does not
- The service set. A small site runs the same five services as a data centre
- Specification
- Sized against the site's circuits, segment count, and retention requirement
Running these services on one governed platform means one patch cycle, one hardening baseline, and one set of evidence, rather than five products each with their own.
How Datum, Mariner and Obscura fit together
The platform, and what you can run on it
These three overlap on purpose, and it is worth being plain about which you need. Datum is the platform. Mariner and Obscura are capabilities that can run on it, or independently, depending on how far you want to take each one.
Start with Datum when
- You need
- The core services a site cannot run without, consolidated and governed
- You get
- Routing, DHCP, secure DNS, SD-WAN and collection on one platform
- Enough on its own
- For most sites, yes
Add the specialists when
- Mariner
- Path selection has to fail closed and justify every decision, rather than simply failing over
- Obscura
- You need data loss prevention and API-level control, not just name and content filtering
- Intercept
- Blocking a name is not enough and the traffic itself has to be inspected in the path
- Together
- They run on Datum and report into the same plane, so adding one is not adding an estate
Built to the benchmark
Compliance
- CIS
- Designed and delivered against the CIS benchmark for the platform
- CMMC
- Built to support the practices a CMMC assessment examines
- Evidence
- Configuration and audit output available per unit, and reportable through Posture
- Consistency
- The same baseline whether the unit is an appliance or a VM, which is what keeps an estate assessable
Operations
- Management
- Reports into the same plane as the rest of the Rover estate
- Service view
- Fits the estate picture Horizon maintains
- Support
- 24 × 7 × 365 NOC for units under a support agreement
- Build options
- COTS, modular variants, and custom builds