Header-only packet analysis at the mirror port.
Signature detection + ML anomaly engine + self-learning feedback loop.
Zero payload access. Zero blind spots.
Designed specifically for operational technology networks where availability beats everything else.
Zero network impact. Rust-based sniffer with AF_PACKET/TPACKET_V3 captures traffic at line rate — headers only, no payload, no decryption.
Isolation Forest with self-learning feedback loop. Mark alerts as true/false positives and the model retrains automatically — getting smarter over time.
Pre-configured rule sets for Modbus TCP, DNP3, EtherNet/IP, BACnet, and S7. OT tags get orange highlighting and auto-escalated severity.
Live alert feed with threat-level gauge, connection graph, PCAP download per alert, enrichment (GeoIP, ASN, DNS), and CSV export.
Optional parallel detection engine. ~40,000 Emerging Threats rules plus OT/ICS rule sets from Digital Bond and Positive Technologies — live reloadable.
Integrates external IRMA IDS alerts into the unified feed. REST polling with automatic token renewal — external alarms appear as first-class citizens.
Every alert stores a Wireshark-compatible PCAP (headers only) in MinIO — download directly from the alert detail view for forensic investigation.
Known network and host inventory with CSV bulk import, GeoIP/ASN enrichment, and automatic unknown host alerts — with Redis caching for speed.
Plug in, boot, done. First-boot wizard configures interface, IPs, and passwords. Automatic system updates with ids-update. No OS admin skills needed.
Apache Kafka at the core — every component is independently scalable and replaceable.
Two paths to production — choose yours.
Boot from USB → First-Boot-Wizard guides you through interface, IP, and password setup. Fully automated thereafter.
Download latest release →Synthetic traffic via built-in generator. No physical mirror port needed for testing.
CYJAN IDS is released under the MIT License — inspect every line, contribute freely, and deploy without restrictions. Security through transparency.
Every component, every rule, every ML model — fully transparent. No black boxes in your security stack.
Add custom Suricata rules, integrate your own alert sources via the IRMA bridge pattern, tune the ML threshold.
Issues, pull requests, and feature discussions happen in the open on GitHub. Your OT environment knowledge is welcome.
Everything about CYJAN IDS in one document — architecture overview, feature list, deployment options, and OT/ICS protocol coverage. Share with your team or management.
Download Brochure (PDF)