Thalamus
Match known attacks, on every protocol you actually run.
Thalamus is the intrusion detection engine inside every Gen0Sec sensor and Synapse agent. It inspects traffic at wire speed, matches against a rule corpus you control, and emits structured alerts straight to Cerebellum or your SIEM.
What Thalamus is for
- Bring your own rule feeds. Thalamus accepts Suricata-compatible signatures — community feeds, ET Open, ET Pro, your own custom rules. No translation step, no proprietary rule language.
- Thirty-plus application protocols. Not just HTTP and DNS. Databases, directory services, remote desktop, and industrial control protocols are parsed in the same engine.
- Suricata-compatible EVE JSON. Around thirty event types, so the SIEM pipelines and dashboards you already have keep working.
- Inspect TLS payloads without terminating TLS. With the uprobe path enabled, Thalamus inspects plaintext Dendrite reads from the process — no proxy, no key escrow.
Protocol coverage
Every one of these has a dedicated parser, so rules can match on protocol fields rather than raw bytes.
| Area | Protocols |
|---|---|
| Web | HTTP/1, HTTP/2, WebSocket, QUIC, TLS |
| SMTP, IMAP, POP3 | |
| Files and shares | FTP, SMB, NFS, TFTP |
| Infrastructure | DNS, DHCP, NTP, SNMP, LDAP, Kerberos, IKE, SIP, DCERPC |
| Remote access | SSH, RDP, Telnet, VNC/RFB |
| Databases | PostgreSQL |
| Industrial (OT) | Modbus, DNP3, EtherNet/IP |
| Other | MQTT, IRC, BitTorrent DHT |
HTTP/1 parses through OISF's libhtp by default, so its quirk handling matches Suricata's. A built-in parser is used instead when libhtp is compiled out.
Output
Alerts are Suricata-compatible EVE JSON, covering alert, anomaly, flow, netflow, stats, fileinfo, frame, packet, drop, and a per-protocol record for most of the parsers above. Records can also carry a Community ID — switch it on with a seed, and a Thalamus event and an event from any other Community-ID-aware tool describe the same flow under the same key.
How it captures
| Backend | Use it for |
|---|---|
| AF_XDP | Highest throughput on Linux. Also where in-kernel elephant-flow bypass is available |
| AF_PACKET | Works on any Linux kernel with no special setup |
| pcap file | Offline analysis and rule testing against a saved capture |
| Windows | Windows hosts, through Dendrite's eBPF/XDP backend |
Flow state is tracked in a lock-free table sized at one million concurrent flows by default, with a configurable idle timeout. Suricata-style thresholding and rate limiting suppress alert floods without dropping the underlying detection.
Thalamus never samples: there is no 1-in-N, no flow sampling, and no percentage. Every packet the engine receives is inspected in full.
Packets can still be dropped before the engine, by the capture layer, if traffic outruns the host.
That is counted and exported as packets_dropped rather than hidden — if the number is not zero,
you are not seeing everything, and the metric is how you find out.
How it fits
Thalamus is the known-bad detector in the platform. Where Cortex catches new threats by behaviour, Thalamus catches the ones the security community has already signature-matched.
Use cases
- Detect known C2 communication patterns across every site.
- Subscribe to threat intel feeds and apply them everywhere instantly — the rules you already licensed for Suricata run unchanged.
- Monitor OT and IT on one engine. Modbus and DNP3 traffic is parsed by the same sensor watching HTTP, so plant and corporate networks share a rule pipeline.
- Inspect encrypted application traffic for hosts where the uprobe path is enabled, without standing up a TLS-terminating proxy.
- Feed Cerebellum the signature hits so it can correlate with ML output and behavioural anomalies.
See also
- Synapse documentation — the agent that ships Thalamus
- Dendrite — supplies the TLS plaintext Thalamus inspects
- Cortex — the ML side of detection
- Amygdala — acts on what Thalamus finds