TEHTRIS NTA is a tactical solution for analyzing your network flows in real time, using flow capture, metadata (NetFlow) and passive audit mechanisms.

Network Traffic Analysis

TEHTRIS NTA is a tactical solution for analyzing your network flows in real time, using flow capture metadata and passive audit mechanisms. Depending on its position in your infrastructure, TEHTRIS NTA can monitor both north/south and east/west flows. Several modules are available in TEHTRIS NTA, including signature-based detection and behavioral-based techniques. TEHTRIS NTA continuously learns and examines all flows to perform advanced analysis and detect network anomalies

By recording metadata in NetFlow mode, TEHTRIS NTA offers the ability to go back in time, finding out who spoke to whom, when and how. Unlike many solutions, TEHTRIS NTA does not require a SIEM to be useful, since the tool is directly integrated into the TEHTRIS XDR Platform. In addition, TEHTRIS NTA is not limited to signature or user behavior analysis to raise alerts. Indeed, some suspicious elements, like lateral movements or slow stealth scans, may be detected in other ways, such as lateral movements, or slow stealth scans.

Latest Updates

why tehtris NTA?


TEHTRIS NTA offers unique network flow monitoring functionalities with a signature-based NIDS component, a network forensic-type component (integrating a tactical behavioral engine), and passive auditing to reduce the area of exposure.


TEHTRIS NTA can be your network monitoring probe, natively integrated to the TEHTRIS XDR Platform with tools for SOAR, CTI, hunting, compliance, incident management and so on.


TEHTRIS NTA easily works with IT or OT environments, because of its unique internal engines. For IT environments, we can regularly catch unwanted activities like backdoors and outbound C&C. Regarding OT, we offer a strong advantage with our passive audit feature, because we can detect legacy security issues hidden in complex plants.


TEHTRIS NTA incredibly simplifies the complexity of network monitoring projects, with TEHTRIS taking on the deployment and maintenance of operational conditions.


TEHTRIS NTA probes do not modify systems in production. They simply add passive collection points, so as not to disrupt the elements already in place.


TEHTRIS NTA runs on appliances using TEHTRIX distribution, which is fully disk encrypted, with advanced protection mechanisms such as RBAC in the kernel and 0-day protection.


Security Orchestration, Automation and Response

When it comes to  cybersecurity, the ability to orchestrate a quick and efficient response to cyber events is a fundamental issue. One of the best ways to achieve this is to use particularly powerful automation and artificial intelligence. This is what TEHTRIS offers you with its SOAR integrated to the TEHTRIS XDR Platform.

Discover our way to create hyper automation!


MITRE ATT&CK is a knowledge base with a modeling of the behavior of a cyberattacker, illustrating all phases of a cyberattack’s life cycle in relation to targeted platforms: Windows, macOS, Linux, mobile devices and so on.

Find out how TEHTRIS is compliant with MITRE ATT&CK

© 2020 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

some figures

1 detection

rules covering all ranges of attacks from industrial to corporate networks

99 hours

of permanent updates of detection rules without human intervention

999 day

to deploy a TEHTRIS NTA appliance with sniffers and configured alarms


TEHTRIS NTA offers several functionalities, with three main axes: the network intrusion detection system (NIDS), the passive auditing system, and the Network Forensic system.

We monitor all possible standard network flows, from Layer 3 to Layer 7.

We have the ability to detect the use of suspicious certificates used in particular by many backdoors that try to filter out in an encrypted manner.

The NIDS part is based on signatures, while the Network Forensic part uses behavioral rules, for example to detect lateral movements and horizontal or vertical scans.

TEHTRIS NTA builds its flow collection directly in the same spirit as NetFlow, keeping the metadata related to the communications between the different devices.

It is advisable to position analysis on strategic points, such as the entry/exit part of a sensitive network.

TEHTRIS NTA includes its own passive audit engine to detect all vulnerable machines on your infrastructure.