01
Detection engines
Four engines working together to give unified visibility across traffic and files.
AIStorm Product
AIStorm ThreatTrace
Network Detection & Response for Advanced Persistent Threats
AIStorm ThreatTrace monitors full-network traffic to identify both known and unknown threats, delivering comprehensive cyber threat visibility. It integrates signature-based detection with extensive threat intelligence, and excels at deep analysis of files transmitted across the network — combining a proprietary detection engine with a customized sandbox for dynamic simulation.
Malicious documents
Malware
Malicious webpages
External communications
Internal attacks
Targeted, evasive threats
4
Detection engines working together
6
Threat categories identified
4
Key product advantages
Overview
Full-network visibility, from detection to response
AIStorm ThreatTrace is a Network Detection and Response (NDR) platform built to catch what signature-based tools miss. It watches every packet crossing your network — not just traffic at the perimeter — combining Deep Packet Inspection, threat intelligence, and a local sandbox to identify both known malware and never-seen-before attacks, then correlates the results into a single, actionable picture instead of a flood of disconnected alerts.
See It In Action
Watch ThreatTrace at work
A walkthrough of detection, tracing and response in a single session.
Video tự phát khi cuộn tới · nhấn biểu tượng loa để bật tiếng
Key Features
Four pillars of full-network visibility
From detection to automated response, ThreatTrace covers the full lifecycle of a network threat.
Threat Detection
- Network intrusion detection
- Threat intelligence detection
- Malicious file detection
- Sandbox dynamic file detection
Traffic Tracing
- Retention of complete access logs
- Retention of metadata for critical protocols
- Retention of network-transmitted files
Network Asset Discovery
- Internal network discovery
- Asset OS and software fingerprinting
- Cloud asset discovery via cloud platform integration
Automated Response
- Integrate with third-party firewalls
- Integrate with third-party EDR
- Block traffic via out-of-band RST packets
Product Advantages
Why security teams choose ThreatTrace
Four engineering strengths that turn raw network traffic into fast, actionable decisions.
01
Integrated Threat Detection and Alert Correlation
ThreatTrace delivers unified threat detection by combining four powerful engines: Deep Packet Inspection (DPI), Network Threat Detection, Threat Intelligence, and Malicious File Analysis. This multi-layered approach ensures broad visibility across network traffic and file behavior.
Key capabilities
- Correlated alert analysis using temporal proximity, shared entities, and recurring attack patterns
- Attack chain reconstruction to expose hidden threats and lateral movement
- Noise reduction that filters irrelevant alerts and lowers false positives
Benefits
- Enhanced situational awareness across the network
- Reduced analyst fatigue through intelligent alert prioritization
- Accelerated threat triage and investigation workflows
02
Local Sandbox for Advanced Threat Detection
ThreatTrace includes a built-in local sandbox that eliminates the need to transmit files to external cloud environments for deep analysis — enhancing privacy, speeding up detection, and ensuring full control over sensitive data. Sandbox environments can be customized to match the user's OS, drivers, applications, and regional settings, improving detection rates by replicating real-world conditions.
Detection techniques
- Static analysis — file structure and code without execution
- Dynamic behavior analysis — baselines for anomalous activity
- Heuristic analysis — anomalies and suspicious patterns
- Malicious document analysis — embedded threats in documents
- Correlation analysis — links findings across engines
Benefits
- Faster, localized threat analysis
- Enhanced detection of ransomware and zero-day exploits
- Reduced reliance on cloud infrastructure
- Improved accuracy through OS-specific sandboxing
03
Risky Host Identification and Forensics
ThreatTrace uses multi-dimensional data — including threat alerts and asset intelligence — to identify host assets within the internal network that may be at risk of compromise. Its built-in asset risk assessment model enables proactive detection of vulnerable or compromised systems.
Key capabilities
- Risky host detection across large alert volumes using contextual threat and asset data
- Attack visualization showing the full attack process and relationship graphs
- Forensic support for investigation, host isolation, and incident response
Benefits
- Accelerated identification of compromised assets
- Enhanced visibility into attack progression and relationships
- Reliable intelligence for containment and mitigation workflows
04
Security Orchestration & Integration
ThreatTrace acts as an orchestration layer, seamlessly integrating with mainstream cybersecurity infrastructure — such as firewalls, EDR platforms, and network gateways. By establishing direct API communication with third-party tools, it bridges the gap between threat detection and active mitigation.
Key capabilities
- Unified orchestration synchronizing disparate security tools into one defense ecosystem
- Real-time enforcement, including blocking malicious IPs and updating firewall rules
- Automated containment via EDR integration to prevent lateral movement
Benefits
- Drastically reduces Mean Time to Respond (MTTR)
- Strengthens security through immediate, policy-based enforcement
- Simplifies incident management through a unified workflow
At a Glance
ThreatTrace in one view
The main building blocks of the platform, side by side.
02
Local sandbox
Built-in analysis with no need to send files to external cloud environments.
03
Traffic tracing
Retains the records needed to reconstruct what happened on the network.
04
Asset discovery
Finds internal and cloud assets and identifies what they run.
05
Response integrations
Connects to third-party firewalls and EDR platforms through direct API communication.
06
Investigation
Visualizes attacks and supports forensic work on compromised hosts.
Threats Covered
What ThreatTrace identifies
Malicious documents
Threats embedded in files transmitted across the network, analysed by the malicious document engine.
Malware
Known and unknown malware, including ransomware and zero-day exploits, examined in the local sandbox.
Malicious webpages
Web-delivered threats detected through threat intelligence and traffic inspection.
Unauthorized external communications
Outbound connections that should not exist, surfaced through network traffic analysis.
Internal network attacks
Lateral movement and attacks between internal hosts, traced through attack chain reconstruction.
Targeted, evasive threats
Advanced persistent threats designed to avoid signature-based tools, caught by combining multiple engines.
Related Solutions
Part of our Cybersecurity domain
Related Products
Other solutions from TOPSEC Vietnam
Get Started
See AIStorm ThreatTrace on your network
Talk to our team for a walkthrough, a proof-of-concept, or a tailored quote for your environment.