# Features — behavioural NDR with explainable alerts > Behavioural network detection, a plain-language explanation on every alert, a conformal false-positive bound, and passive OT/ICS and shadow AI visibility. Source page: https://netsenx.com/en/features ## What NetSenX does on your network, and how you can check it NetSenX product capabilities NetSenX watches how the hosts on your network behave, raises an alert when that behaviour looks like an attack, and explains every alert in plain language. Detection output passes through a conformal layer that states the confidence behind it, and every model version is recorded. Below is what each capability does, which plan it needs, and what it does not do. Conformal false-positive bound Customer data stored in the EU A plain-language reason on every alert Highlights See how the bound is reported #### Behaviour, not signatures Behavioural detection The engine scores how each host behaves on the network, so a new malware variant without a signature still leaves a trail. It watches for the steps that come before data leaves: command-and-control beaconing, scanning, lateral movement and unusual outbound data volume. NetSenX works alongside your EDR and SIEM. It adds the network view they do not have; it does not replace them. Command-and-control (C2) beaconing Scanning and lateral movement Unusual outbound data volume #### NetSenX Math Guarantee Bounded false positives A split-conformal layer derives a finite-sample false-positive bound on the alerts the engine surfaces, at a confidence level you configure, from benign traffic your analysts have labelled on your own network. The bound is a property of the construction, not a threshold tuned until the numbers looked good. Each alert shows its confidence in plain words, together with the model version that produced it, and an alert whose score is not calibrated is labelled preliminary. Your auditors see the same evidence your team sees. Your dashboard reports the bound your calibration data currently supports. When it supports none yet, the dashboard says so and names what would close the gap, instead of showing a figure it cannot back. Split-conformal bound at a stated confidence level A plain not-yet-supported state instead of an invented number Included on every plan, Free included #### Network-wide correlation Lateral movement Per-flow detection sees what happens on one connection. Attacks rarely stop at one host: after the first foothold, an intruder scans, signs in to the next machine and works towards the data. From the Pro plan, NetSenX correlates the hosts on your network into a graph of who talks to whom, so lateral movement and groups of hosts beaconing to the same destination show up as one story instead of scattered alerts. These alerts carry the hosts and connections behind them as evidence, ready for an incident write-up or a report to your authority. Lateral movement and C2 clusters across hosts The hosts and connections behind each alert Named MITRE ATT&CK technique where one corresponds #### NetSenX TLS Fingerprint Engine Encrypted traffic Attack tooling leaves a signature in the TLS handshake before it moves any data. From the Starter plan, NetSenX reads the handshake parameters and identifies suspicious clients at the handshake, before a payload is exchanged. The handshake is visible only where the agent captures packets: on Linux or as a sensor on a SPAN or TAP port, not in the basic mode used on macOS. It works on encrypted connections without decrypting them: there is no interception proxy to run and no certificate to install on your devices. One handshake feeds both the per-host behavioural score and the network-wide correlation. Identification at the handshake, before any payload No TLS decryption Feeds per-host and network-wide detection #### NetSenX AI Analyst Core Plain-language triage Many NDR alerts arrive as raw fields and leave as tickets. With the AI Analyst Core switched on, each alert gets a plain-language note: what happened, why it matters and what to do next. Notes are written by version-pinned models whose lineage is recorded, and they are structured for CRA Article 14 and NIS2 Article 21 reporting, so the facts your incident report needs are already in one place. It runs with your own AI provider key on every paid plan and is off until you set it up. Detection works without it. A plain-language note per alert Structured for CRA and NIS2 reporting Model version recorded on every note #### Industrial protocols, observed passively OT / ICS · Pro plan and up Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP and S7comm are read from passive capture on a SPAN or TAP port. Devices classified as OT are never actively probed, so there is no risk to PLCs or SCADA systems and nothing changes on the controllers. OT traffic appears in the same dashboard as the IT network, with the same plain-language explanation on every alert. Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP, S7comm No active probing of OT devices From the Pro plan #### See which AI services your network uses Shadow AI · Pro plan and up NetSenX flags traffic to external AI services and to language-model runtimes running on your own machines, so unapproved AI use becomes visible before it turns into a data-protection issue. You see which host reached which AI service, when, and how much data moved. Encrypted traffic is never decrypted, so the content of a prompt stays unread. Start by finding out what is actually in use; then write an AI policy your staff can follow. External AI services and local model runtimes Which host, which service, how much data From the Pro plan #### Audit-ready compliance Evidence included NetSenX tracks each incident against the NIS2 Article 23 deadlines — early warning within 24 hours, notification within 72 hours, final report within one month — and prepares a GDPR Article 33 breach notification for your DPO. Submitting reports stays with you. Alerts, analyst decisions and configuration changes are written to an audit log you can hand to your auditor, and the evidence is organised for CRA, NIS2, GDPR and AI Act reviews. SOC 2, ISO/IEC 42001 and ISO/IEC 27001 are in preparation; none is awarded yet, and we publish a date only once an audit is booked. NIS2 deadlines tracked per incident Audit log of alerts, decisions and changes SOC 2, ISO 42001 and ISO 27001 in preparation ### A false-positive bound you can check, not a number you have to believe. NetSenX Math Guarantee A split-conformal layer sits after detection and derives a false-positive bound on the alerts the engine surfaces, at a confidence level you configure, from benign traffic your analysts have labelled on your own network. Your dashboard reports the bound that data currently supports, and when the calibration set is too small it says so instead of showing a figure. Bounded by construction Reported from your own data #### Split-conformal prediction Each alert states its confidence in plain words, and says so when its score is not yet calibrated. Where the statistical guarantee applies, the false-positive bound among engine-surfaced alerts comes from the construction of the predictor at a stated confidence level; it is not a threshold tuned until the numbers looked good. #### Model governance Models are version-pinned and their lineage is recorded. The Math Guarantee belongs to the AI management system we are building to ISO/IEC 42001, not to a marketing footnote. #### What we commit to The mechanism and the evidence: the bound your calibration data supports, the sample size behind it, and a plain not-yet-supported state when it supports none. We do not publish a false-alarm figure we have not measured on your data. What your dashboard reports Five states, four of them without a number Not yet calibrated Too little analyst-labelled benign traffic to support any bound. The product says exactly that and names what would close the gap; it does not show a zero. Active — wider bound Calibration data supports a bound, but a looser one than the configured target. The product states that it stands behind the wider bound and still shows no figure, because the tighter target was never reached. Active — target bound Calibration size supports the configured confidence level. This is the one state that carries a number, and it never arrives alone: the bound, the count of audited samples behind it and the window they were measured over are shown together. Awaiting recalibration The calibration behind the bound has aged out, or the traffic it was built on has drifted from what the network looks like now. The bound is withdrawn until a fresh calibration replaces it; a stale number is not kept on screen because it used to be true. Re-validating A calibration update is being verified before it takes effect. The previous claim is withdrawn while that runs. These are the states the product actually serves: no state reports a bound the calibration data does not support. We publish no comparison figures for other vendors, because we have not run those tests. ### Every alert comes with a note an analyst can act on. NetSenX AI Analyst Core Raw alert data is paired with a plain-language note: what happened, why it matters and the recommended response, structured for your CRA Article 14 and NIS2 Article 21 reporting. Alert payload · illustrative sample severity: high Analyst note auto-generated Beaconing detected from finance-srv-04 to a previously unseen domain (delta-cargo-track.xyz) registered 6 hours ago. Outbound traffic is small, periodic and low-jitter: a pattern consistent with command-and-control after an initial compromise. The graph layer also observed two peers on the finance subnet (finance-srv-02, finance-srv-09) looking up the same domain within the last 90 minutes. Recommended response Isolate finance-srv-04 from the production VLAN. Capture a memory image before rebooting, for forensic review. Check the finance subnet for other hosts contacting the same domain or IP address. Open a ticket under your incident response runbook; the alert is already structured for CRA Article 14 incident logging. Illustrative example, not a captured detection. Notes are written by version-pinned models whose lineage is recorded. Related pages ### See it on your own network Start on the Free plan with up to 3 devices: no time limit, no credit card. Or book a 20-minute demo and we will walk a live alert from capture to analyst note, with the audit trail visible at every step. Start free Book a demo