On your appliance
Operate inside a disconnected or controlled environment. Operational data and the working view can remain local.
Deployment
Your environment.
Your data boundary.
Choose an on-site, hybrid or connected operating model. The deployment architecture follows the environment’s constraints instead of assuming every raw event belongs in a remote service.
EndpointFirewallSwitchHypervisor
DUNFAIRE APPLIANCECollect · identify · groupRaw operational logs can remain here
CONTROLLED BOUNDARYidentified conditions
+ stable identity
+ occurrences
+ stable identity
+ occurrences
OPERATIONAL VIEWPrioritised incidentsAccess depends on the selected model
On-siteOperational data stays local HybridConditions cross a defined boundary ConnectedAgents and connectors report directly
Operating models
Three ways to create
one clear view.
Hybrid boundary
Keep raw logs on-site while identified conditions, stable identity and occurrence information cross a defined boundary.
Connected estate
Use agents and connectors where direct reporting is operationally and policy-appropriate.
Disconnected discovery
Learn what is present
without probing it.
Passive discovery reads ARP tables and switch forwarding databases without sending traffic to the devices it discovers.
A local IEEE MAC vendor dataset ships with 53,584 assignments. Its checksum is verified at load and the dataset is refused if it has been altered.
53,584local assignments0discovery probes to found devices
Define the data boundary before selecting the model.
Map your architecture ↗