ACTIVE PROBING
Copied traffic only.
PASSIVE CYBER OBSERVATION SYSTEMSIH 2026 / PS 26145 / NTRO
See the threat.
Never touch the network.
TRINETRA detects threats from copied traffic—without probing, decrypting, or sending anything back.
PASSIVE / READ ONLY / NO DECRYPTION / STREAMING
TRINETRA / STATUSAPI + WS
- BOUNDARY
- UNVERIFIED
- DETECTORS
- CONNECTING
- STREAM
- RECONNECTING
Software enforcement · no physical diode certification
Protected network → receive-only boundary → TRINETRA. Packets travel left to right. A reverse signal stops at the boundary. Behavioural features reach nine detector modules, then evidence and the analyst. This animation explains the architecture; it does not depict live detections.
NTRO / PROBLEM STATEMENT 26145
When the network
can’t answer,
TRINETRA still sees.
It detects threats from copied traffic without probing, decrypting, or sending anything back.
Problem, validation and limitations ↗OBSERVE WHAT CROSSES.
INFER FROM BEHAVIOUR.
RETURN NOTHING.
PAYLOAD DECRYPTION
TLS and QUIC stay encrypted.
BATCH ANALYSIS
Events are processed continuously.
INLINE MITIGATION
Detects; never blocks or sends.
EXPLORE THE SYSTEM