Cognito Sensors provide native visibility into attacker behaviors in the Azure cloud. The Azure Virtual Network TAP copies virtual network traffic into, out of and between virtual machines and makes it available to the Cognito Sensor running in Azure. The Cognito Brain then extracts security-enriched metadata from this traffic for real-time detection and prioritization of advanced threats. Cognito Sensors enable Vectra to provide complete cyberattack visibility – without requiring agents – into Azure cloud environments. Unlike agent-based traffic visibility and security products, the Azure Virtual Network TAP will collect network traffic from the hypervisor to avoid compromises and vulnerabilities that affect agents on virtual machines. Cognito Sensors monitor and collect all traffic through the Azure Virtual Network TAP and send it to the Cognito Brain for real-time analysis of attacker behaviors.

Cognito Stream sends security-enriched metadata to data lakes and SIEMs. Hundreds of metadata attributes are extracted from raw cloud traffic and presented in a compact, easy-to-understand Zeek format that leverages existing software tooling. Security insights generated by machine learning are embedded in the enriched metadata to provide powerful building blocks that threat hunters can combine with their own unique expertise to reach faster conclusions. Cognito Stream automatically associates security-enriched metadata with other attributes to create a unique host identity. This enables security analysts to efficiently investigate hosts, regardless of IP address changes as well as explore relationships between groups of hosts.