- PlatformCore Detection & ResponseEDRAdvanced endpoint detection and response with deep visibility, autonomous containment, and analyst-driven investigationNDRNetwork detection and response powered by full packet capture, session reconstruction, and AI-driven anomaly detection.CloudUnified cloud protection across workloads, identities, and SaaS apps, combining visibility with runtime defense.MobileEndpoint security for iOS and Android, detecting malicious apps, phishing attempts, and device-level exploits.IoT/OTCritical asset visibility and threat detection for industrial and IoT environments—without downtime or blind spots.Human Threat Actor CoverageIntelligenceGlobal threat intelligence aggregated from 300+ sources, mapped to your environment for real-time detection and context.Attack ValidationAutomated adversarial validation to confirm detections, test controls, and prioritize real threats over noise.DeceiveDeception technology that lures attackers into decoy environments, revealing tactics before damage is done.IdentityIdentity threat detection and protection with real-time monitoring of Active Directory, Entra ID, and credentials.Post-Breach Forensics & IRPacketsFull-fidelity network forensics with packet capture, file extraction, and retrospective analysis.SIEMCentralized log management and correlation across all telemetry sources for complete security visibility.ReconContinuous adversarial exposure management—simulating attacker reconnaissance to surface hidden weaknesses.
- MDR
- Why LMNTRIX
- Active Defense
- Use CasesBusiness Use CasesReliable & Thorough CybersecurityElevate Security OperationsCross Product CorrelationTech Use CasesCloud Security SimplifiedOptimizing SIEM Security with Next-Gen Detection ToolsAchieve Excellence in Security OperationsComprehensive MITRE ATT&CK Coverage for All StagesEnvironment Use CasesMDR for AWS Cloud Security – 24/7 Detection & ResponseManaged Detection & Response for Google Cloud SecurityAdvanced Microsoft MDR Security for Threat Defense
- LMNTRIX vs the CompetitionLMNTRIX vs other vendorsvs. CrowdStrikeOverhyped, Overpriced & Always Breachedvs. SentinelOneLimited protection, unable to prevent breachesvs. MicrosoftComplex operations increase TCOvs. Palo Alto NetworksDifficult to implement, operate, & maintainvs. SophosOverpriced and Overcomplicatedvs. Trend MicroLimited to own ecosystem & threat of DevOps interruptionsvs. DarktraceOver-promises with flashy AI marketing but always under-deliversvs. other MDRsSlow MDRs that miss threats and leave you to fix the damage
- Ask LISA
LMNTRIX Packets
Deep Network Forensics and Autonomous Threat Hunting
Capture full-fidelity network traffic, reconstruct sessions, extract evidence, revisit historical activity, and hunt for threats that logs and flow data cannot explain.
A Time Machine for Your Network
Preserve packet-level evidence and rich metadata so analysts can see what happened, how an adversary moved, and what data was affected.
Full-Fidelity Packet Capture
- Capture packet headers and payloads for forensic accuracy.
- Deploy sensors in SPAN or TAP mode at core, edge, cloud, and other strategic locations.
- License by total throughput rather than sensor count.
Key Benefits
Answer the Questions
Logs Cannot
Use packet-level evidence to validate alerts, investigate incidents, and uncover threats that evolve over time.
- 01Historical Threat HuntingSearch retained packet metadata for indicators, behaviors, and attacker techniques.
- 02Incident ReplayReconstruct communications and timelines to understand entry, movement, and impact.
- 03Malware AnalysisExtract transferred files and preserve evidence for deeper examination.
- 04Zero-Day & LotL DetectionIdentify unusual behavior and attacker tradecraft that known signatures may miss.
- 05Policy & Compliance ValidationAudit network behavior and verify that security controls operate as intended.
- 06Cross-XDR InvestigationPivot from NDR, EDR, SIEM, or Deception alerts into the underlying packet evidence.
- 01. Historical Threat Hunting — Search retained packet metadata for indicators, behaviors, and attacker techniques.
- 02. Incident Replay — Reconstruct communications and timelines to understand entry, movement, and impact.
- 03. Malware Analysis — Extract transferred files and preserve evidence for deeper examination.
- 04. Zero-Day & LotL Detection — Identify unusual behavior and attacker tradecraft that known signatures may miss.
- 05. Policy & Compliance Validation — Audit network behavior and verify that security controls operate as intended.
- 06. Cross-XDR Investigation — Pivot from NDR, EDR, SIEM, or Deception alerts into the underlying packet evidence.
Preserve the Context Needed to Investigate
Flexible retention and broad protocol visibility give responders the evidence required for current and retrospective analysis.
Default Packet Retention
Extended Retention
Protocols and Applications
-
Capture
-
Reconstruct
-
Enrich
-
Hunt
-
Prove
Questions.
Clear answers.
Clear answers about packet capture, retention, deployment, and threat hunting.
LMNTRIX Packets is the network-forensics module of LMNTRIX XDR. It records packet data and metadata so analysts can investigate, retrospect, and hunt across historical communications.
NDR focuses on detecting suspicious network activity, while Packets preserves full-fidelity evidence and searchable metadata for deep investigation. It provides more detail than flow-only records.
Sensors are deployed on customer-controlled SPAN or TAP connections after perimeter controls and at other strategic network locations.
The current page specifies 30 days by default, with extended retention available up to 12 months depending on the selected storage and deployment model.
It can analyze encrypted-traffic characteristics and can integrate with supported third-party TLS decryption technologies when payload inspection is required.
When new threat intelligence or detection logic becomes available, LMNTRIX can re-examine stored traffic to find activity that was not recognized as malicious when it first occurred.
