Platform Overview

42 modules.
6 security domains.
One unified platform.

XDRagon Monitor integrates every layer of your security operations — from raw packet inspection to autonomous AI analysis and regulatory compliance — into a single self-hosted platform with no external data dependency.

42
Platform Modules
6
Security Domains
10+
Threat Intel Sources
10+
ML & Statistical Detectors
Six Domains. One Platform.

Everything your team needs.
Nothing you don't.

Six purpose-built domains cover the full detection and response lifecycle. Every module shares a common data bus — events flow automatically between the network layer, AI analysis engine, endpoint sensors, and compliance framework.

01
DOMAIN 01
Network Detection & Response
Suricata IDS/IPS engine inspects all traffic. Firewall log integration across 5+ vendors — pfSense, OPNsense, FortiGate, Sophos XG/XGS, and UniFi/EdgeOS — plus pfBlockerNG. Geographic enrichment, threat feed correlation, and MITRE ATT&CK mapping on every alert.
Live Threat Dashboard
Real-time alert feed with severity classification, geographic heatmap, and 24-hour trend charts.
Core
Suricata IDS/IPS
Full Suricata integration — inline IPS mode, custom rule sets, performance statistics, and alert drill-down.
Core
Threat Feed Hub
10+ sources — URLhaus, ThreatFox, AbuseIPDB, VirusTotal, AlienVault OTX, GreyNoise, urlscan.io, Shodan, CISA KEV, MalwareBazaar, CINS Army, and Blocklist.de. Automatic correlation on every alert.
Core
Firewall Log Integration
Pulls firewall logs via syslog from pfSense, OPNsense, FortiGate, Sophos, and UniFi. Visualises allowed/blocked traffic, GeoIP, top talkers, and bandwidth trends.
Core
pfBlockerNG Module
Block-list analytics — which domains were blocked, by which list, with frequency and trend data.
Core
UniFi / EdgeOS Integration
Syslog parser for UniFi gateways and EdgeOS, plus Suricata-compatible eve-log ingest from UniFi Threat Management. Requires syslog forwarding setup — a step-by-step guide is built in. Controller-based client and AP telemetry is not integrated.
Core
MITRE ATT&CK Overlay
Every Suricata alert tagged to the MITRE matrix. Coverage heatmap shows gaps and hot spots across 14 tactics.
AI
AI Red Team Simulator
Built-in attack simulation with MITRE-mapped scenarios — slow scans, beacon jitter, DNS tunneling, and more — run against your own deployment. Produces a detection-gap report per scenario. No external tools required.
AI
Multi-Vendor Firewall Support
Log parsers for pfSense, OPNsense, FortiGate, Sophos XG/XGS, and UniFi/EdgeOS — run multiple firewalls simultaneously, with automatic format detection per stream and step-by-step setup guides for each vendor.
New
Retrospective IOC Hunt
Newly arrived threat indicators are automatically matched against up to 180 days of historical events — with on-demand backfill and alerts on critical hits.
New
Dark Web Monitoring
Monitors your own domains against known breach data via Have I Been Pwned. Leaked credentials are correlated with observed login activity.
New
02
DOMAIN 02
Autonomous AI SOC
Six specialised Ollama LLM models run locally on your hardware. Seven autonomous background jobs classify, correlate, and brief your team — around the clock. All inference stays on-premises.
AI Morning Briefing
Structured security summary at 07:00 — top threats, anomalies, and recommended actions from the past 24 hours.
AI
Threat Classifier
qwen2.5:7b model classifies every alert every 2 minutes. Severity score, attack type, and confidence level.
AI
Correlation Engine
Cross-source correlation runs every 10 minutes. Links network, DNS, and endpoint events into unified incident threads.
AI
C2 Beaconing Detector
Statistical interval-regularity analysis of connection timing surfaces periodic beaconing to command-and-control infrastructure. Runs automatically every 15 minutes.
Core
pgvector RAG Search
Semantic search across all historical alerts. Ask natural-language questions about past incidents.
AI
Smart Alerting
7 rule engine alerts with AI context enrichment — geo-blocked IPs, new external services, anomalous uploads.
AI
UEBA — Entity Behavior
Behavioral baselines for both users and hosts — logins and processes. Flags impossible travel, credential stuffing, and off-hours admin activity, with a risk tier per entity.
New
Integrations & Webhooks
Push alerts to Slack, Teams, and PagerDuty via signed webhooks. Telegram notifications, Active Directory/LDAP user enrichment, and a documented REST API with outbound webhooks.
New
03
DOMAIN 03
Endpoint XDR
Lightweight mTLS-encrypted agents for Windows 11 and Ubuntu. pySigma detection rule engine with 11 curated rules pre-loaded. Full SigmaHQ library import with one click.
Windows 11 Agent
Collects process events, file changes, network connections, authentication logs. Sigma rule matching in real time.
Core
Ubuntu Linux Agent
Sysmon for Linux integration, auditd log collection, SSH events, crontab monitoring, and service state changes.
Core
Sigma Rule Engine
pySigma backend with 11 curated detection rules. Import thousands of community rules from SigmaHQ with one click.
Core
Endpoint Dashboard
All enrolled endpoints, health status, last seen, and event stream. Cross-agent correlation with network events.
Core
04
DOMAIN 04
Active Defense & Deception
Deploy realistic honeypot sensors with authentic personas. No legitimate user should ever touch a decoy — every interaction is a high-confidence alert. Canary Tokens extend deception into files and documents.
SSH Honeypot
Realistic SSH server that logs every connection attempt, credential probe, and command executed by intruders.
Core
Linux Server Lure
Ubuntu-persona decoy with SSH and HTTP services. Logs every connection attempt, credential probe, and command executed.
Core
Windows Workstation Lure
SMB/RPC emulation. Captures credential harvesting, lateral movement probes, and ransomware spread attempts.
Core
IoT Printer Lure
Network printer persona placed automatically in the right VLAN. Printers don't get probed by legitimate users — any connection attempt is an immediate alert.
New
Canary Tokens
Embed undetectable tripwires in Word docs, PDFs, and scripts. Fires instantly when opened outside your network.
New
05
DOMAIN 05
DNS Security & Analytics
Deep DNS telemetry for detecting data exfiltration, C2 tunneling, and algorithmically generated domain names. Passive DNS with historical lookup correlation.
DNS Traffic Analyser
Top queried domains, query frequency charts, NXDOMAIN spike detection, and resolver performance metrics.
Core
DGA Detector
ML model scores every queried domain for algorithmic generation patterns. Catches C2 infrastructure before it beacons.
AI
DNS Tunneling Monitor
Entropy analysis and payload-length heuristics detect data exfiltration via DNS queries.
AI
Fast-Flux Tracker
Monitors TTL patterns and A-record rotation to identify fast-flux infrastructure used by malware operators.
AI
06
DOMAIN 06
Compliance & Governance
Live scoring against NIS2 Article 21, NIST CSF 2.0, and CIS Controls v8.1. Automated evidence collection with human-approval workflow. Audit-ready ZIP export in one click.
NIS2 Compliance Engine
Article-by-article scoring for NIS2 Art. 21. Gap analysis with AI-written remediation guidance for each open item.
Core
NIST CSF 2.0 Module
Complete mapping to all 6 NIST functions — Govern, Identify, Protect, Detect, Respond, Recover. Evidence auto-attached.
Core
CIS Controls v8.1
18 safeguard families with automated evidence from your live telemetry. Score tracked over time for audit trending.
Core
Evidence & Audit Export
Every piece of evidence is logged, timestamped, and stored. Approve via workflow, then export a complete audit ZIP.
New
AI Remediation Advisor
For each compliance gap, the AI analyses your actual telemetry and produces a context-aware remediation plan.
AI
Field Agent Scanner
Nmap + Nuclei scanning via field agents. CVE correlation against CISA KEV. Findings surfaced in asset risk scoring and compliance.
New
Patch Priority
One ranked answer to "patch these first" — CISA KEV status, CVSS, and asset criticality combined into a single score. Version-aware CVE matching and ransomware flags.
New
Reporting Suite
Board report PDF with automatic monthly email, executive monthly report, weekly threat intelligence report, and shift-handoff notes for your team.
New
Backup & Restore
Automatic scheduled database backups with a guided restore wizard — including a safety backup before every restore. Status surfaced in the health dashboard.
Core
System Health
Self-monitoring of every platform service — database, IDS engine, local AI, scheduler, disk, and memory — with traffic-light status and 24-hour history.
Core
DETECTION COVERAGE

Threat coverage map — what XDRagon Monitor detects across your attack surface

XDRagon Monitor threat coverage map
Self-Hosted. Your Rules.

Choose the right architecture
for your environment

XDRagon Monitor runs entirely on your hardware. Three deployment modes address different network topologies and security requirements — from a single-server lab to an air-gapped production network.

Integrated Mode
All platform services run on a single server alongside the sensor. Ideal for small networks, lab environments, and initial deployments.
Single-server deployment
Docker Compose — single command
Supports x86-64, ARM64
GPU acceleration optional
Network path separation
Recommended
Segmented Mode
Sensor runs on a dedicated machine in the network path. Analysis server sits in a management VLAN. Stronger security posture for production environments.
Sensor / server separation
Management VLAN isolation
mTLS between all components
Supports multi-site sensors
GPU acceleration supported
Physical Diode Mode
Data flows through a one-way hardware diode. No return path from the analysis server to the monitored network. Designed for OT/ICS and high-security networks.
Hardware data diode support
Zero back-channel from server
OT / ICS network ready
Air-gap compatible
Regulatory-grade isolation
Honest Capability Assessment.

What XDRagon Monitor does —
and doesn't do

XDRagon Monitor is a detection, analysis, and compliance platform. It is not a managed service, and it does not replace your firewall or endpoint AV.

XDRagon Monitor handles this
Real-time network intrusion detection and prevention
AI-assisted threat classification and correlation
Endpoint process, file, and network event collection
Honeypot and deception infrastructure management
DNS anomaly detection — DGA, tunneling, fast-flux
NIS2 / NIST / CIS compliance scoring and evidence
Autonomous morning briefing and alert enrichment
MITRE ATT&CK coverage mapping
Not in scope
Firewall rule management (works alongside your existing firewall)
Antivirus / malware removal on endpoints
Managed detection & response (MDR) service
SIEM log archival beyond 12-month rolling window
Cloud-native workload monitoring (AWS/Azure/GCP)
Identity and access management
Capability Matrix

Feature availability by deployment mode

Feature Integrated Segmented Physical Diode
Suricata IDS/IPS
Network Detection
✓✓✓
10+ Threat Intel Sources
Threat Intelligence
✓✓✓
Autonomous AI SOC
AI Analysis
✓✓✓
GPU Acceleration
AI Analysis
✓✓—
Endpoint XDR Agents
Endpoint
✓✓✓
Honeypot Sensors
Active Defense
✓✓✓
DNS Analytics
DNS Security
✓✓✓
NIS2 / NIST / CIS Compliance
Compliance
✓✓✓
Multi-site Sensors
Architecture
—✓✓
Hardware Data Diode
Architecture
——✓
RISK SCORING

Asset risk score — how XDRagon Monitor prioritises what needs your attention first

Asset risk scoring diagram

Ready to deploy?

Get the full XDRagon Monitor platform running on your own hardware in under an hour.

Deployment Guide Architecture Deep-Dive →