Inline intrusion prevention · server form factor
Rover Intercept
An inline intrusion prevention system in a server chassis, with threat intelligence built into the product rather than bolted onto it. Intercept sits in the traffic path and stops what it recognises, and the intelligence deciding what it recognises is yours to extend.
Inline means inline
Detection tells you afterwards. Prevention decides at the time.
A detection system watches a copy of the traffic and raises an alert. By the time anyone reads it, the session it describes has completed. Intercept is in the path: traffic passes through it, and what matches is dropped rather than recorded and forwarded.
That placement is the whole value and also the whole risk, so the answer is in the hardware. Intercept inspects through a bypass NIC that holds the link up on its own if the software stops, the appliance loses power, or the unit comes out for maintenance. The inspection path can fail without the link failing with it.
What the link then does is a setting rather than a property of the product, chosen per site. A site that cannot afford to lose the link and a site that must not pass uninspected traffic are different problems, and the same appliance answers both.
The intelligence is the product
Threat intelligence you can add to
Integrated
- Included
- Threat intelligence ships with the product rather than as a separate subscription to negotiate
- Updates
- Indicators reach the enforcement point as policy, without a change ticket per feed refresh
- Coverage
- The commercial and open intelligence most estates are already paying for, consolidated
Customisable
- Your indicators
- Load your own, including intelligence you are not able to hand to a vendor
- Tuning
- Suppress, promote, or scope a source rather than accepting a feed whole
- Programme-specific
- Indicators that apply to one contract, one enclave, or one period, without polluting the rest of the estate
- Stays put
- Custom intelligence remains on the device, inside your boundary
Form factor
Platform
- Chassis
- Standard rack server rather than a proprietary appliance
- Scaling
- Throughput follows the server specification, so capacity is a sizing exercise rather than a product tier
- Silicon
- No vendor-locked inspection hardware to design a refresh cycle around
- Placement
- Data centre or site comms room, in the path of the links you choose to inspect
Deployment
- Bypass
- Hardware bypass NIC, independent of the inspection software and of appliance power
- Fail mode
- Fail-open or fail-closed, set per site rather than fixed in the product
- Scope
- Chosen links rather than everything, so inspection lands where it earns its latency
- Telemetry
- Events feed your monitoring, including collection running on Datum
- Sizing
- Specified against link throughput, inspection depth, and retention
Three products, three layers
Intercept, Datum and Obscura stop different things
All three block. They do it at different layers, and a serious estate usually wants more than one. Which you need depends on what you are trying to stop.
Datum
Stops a device reaching a known-bad destination by refusing to resolve the name. Cheap, estate-wide, and works on endpoints you cannot install anything on. It does not see inside the traffic.
Intercept
Inspects the traffic itself and drops what matches. Catches what never asked DNS a question, including direct-to-address activity and exploitation of a service you meant to expose.
Obscura
Looks at what applications send and return, and stops controlled information leaving or a call an application should not honour. Concerned with your data going out, not an attack coming in.
Datum answers "should this device be talking to that". Intercept answers "is this traffic an attack". Obscura answers "should this data be leaving". Different questions, and no one of them covers the other two.