Network security monitoring
Full-packet capture, protocol metadata and signature detection from passive taps, with optional AI-driven network detection and response.
- Security Onion
- Zeek
- Suricata
- Full PCAP
- MixMode
Mission capabilities
Monitor, hunt, analyze, deceive, validate and train, fully offline.
Rhombus integrates proven open-source and commercial tools into mission packages you can deploy on demand. Every package is hardened, networked in its own segment and managed by the platform.
Commercial product, licensed as part of your configuration. All other tools shown are open source. Product names are trademarks of their respective owners, and their use doesn't imply endorsement.
SIEM & analytics
Search, correlate and visualize the kit's sensor data, fully offline, on the analytics platform your analysts prefer.
- Elastic
- SOF-ELK
- Malcolm
- Splunk Enterprise
Threat intelligence
A threat-intel platform with offline feed mirrors and one-step indicator lookups from the sensor console.
- MISP
- CISA KEV
- CISA joint advisories
- CIRCL OSINT
- Offline feed mirrors
- STIX import
Malware analysis & RE
Automated triage plus a Linux reverse-engineering workstation on a separate malware segment.
- Assemblyline
- REMnux
- YARA
- ReversingLabs Spectra Analyze
Digital forensics & IR
Disk forensics and endpoint triage on the kit, with evidence kept on site.
- Autopsy
- Velociraptor
- Magnet Forensics
Cyber deception
Deploy decoys and breadcrumbs to detect and study adversaries, then exercise them with automated adversary emulation.
- CounterCraft
- MITRE Caldera
Offensive validation
Prove your detections fire. Run emulated attacks against a live Active Directory range and hunt the results.
- Kali Linux
- Atomic Red Team
- PurpleSharp
- MITRE Caldera
Training range & CTF
Multi-tenant labs, vulnerable targets, PCAP replay and scored challenges on the same kit you deploy with.
- CTFd
- OWASP Juice Shop
- DVWA
- PCAP replay
Application delivery & security
F5 BIG-IP Virtual Edition, optional and licensed separately, load-balances kit services. SSL Orchestrator (SSL-O) can be added for decrypted traffic inspection.
- F5 BIG-IP VE
Analyst workspaces
Every tool is delivered to the browser. Nothing gets installed on analyst laptops.
- Keycloak single sign-on
- FreeIPA directory
- Mattermost
Open by design
Your tools. Your data. No lock-in.
- Standard, well-known tools your analysts already train on, not a proprietary stack
- Your analysts' choice of analytics: we deploy the platform your team prefers, whether Elastic in Security Onion, SOF-ELK, Malcolm or Splunk Enterprise configured before delivery by our Splunk Core Certified Consultants
- All data stays on the kit with no cloud dependency required
- Add your own VMs from hardened templates, including Windows and Linux
- Documented REST API for integration with your existing workflows
See the full lifecycle in 90 minutes.
Our end-to-end briefing takes a Rhombus kit from power-on through detection, investigation, evidence export and reset to baseline. It runs on real hardware, fully offline.