DOCSEARCHbyAlgolia
Submit Docs

Gen0Sec Documentation

website·Indexed 31 days ago

https://docs.arxignis.com

Documentation for Gen0Sec, an Active NDR platform featuring Synapse, a high-performance reverse proxy and firewall built in Rust. It utilizes eBPF/XDP for kernel-native threat detection and packet filtering at wire speed, including full JA4+ fingerprinting. The platform also includes Cerebellum, an enterprise self-hosted version for Kubernetes clusters, with support for native Kubernetes Ingress and Gateway API.

Tokens
82.2K
Snippets
303
Records
575
Agent score
50%

What's inside Gen0Sec

  1. Overview of JA4+ Fingerprinting in Synapse

    Synapse implements the complete JA4+ fingerprinting suite for advanced threat detection and behavioral analysis. The suite consists of several components used to identify clients, servers, and network behavior:
    ComponentStatusDescription
    JA4✅ CompleteTLS ClientHello fingerprinting
    JA4T✅ CompleteTCP SYN options fingerprinting
    JA4H✅ CompleteHTTP header fingerprinting
    JA4L✅ CompleteLatency/RTT measurement
    JA4S✅ CompleteTLS ServerHello fingerprinting
    JA4X✅ CompleteX.509 certificate fingerprinting

  2. Overview of Hillock kernel-level firewall

    Hillock is a kernel-level firewall embedded within every Synapse agent. It is designed to drop, filter, or rate-limit malicious traffic before it reaches the application stack. Because it operates at the kernel level, it eliminates the need for a proxy in the traffic path, avoids TLS termination overhead, and introduces no latency penalty.

  3. Overview of Hippocampus

    Hippocampus is the platform's map-builder and control-plane component. It transforms observed network traffic into a graph of workloads and the edges between them. Unlike other components that reason about single connections, Hippocampus reasons about the entire estate to determine what talks to what and what should be allowed to talk.

    Key capabilities include:

    • Traffic Mapping: Converts observed connections into a workload graph.
    • Durable Workload Identity: Resolves transient addresses (like pod IPs) back to the underlying workload, allowing policies to be defined by service name rather than IP.
    • Policy Comparison: Compares 'declared' allowed edges against 'observed' real connections to identify violations.
    • Reachability Analysis: Determines what a workload can reach based on the current map.

  4. Overview of Gen0Sec Platform Components

    Gen0Sec is a multi-layer Active NDR platform providing protection from the kernel level to the application layer. It consists of four primary components that can operate independently or together:

    • Synapse: An eBPF-powered firewall and reverse proxy written in Rust.
    • Cerebrum: Inline hardware sensors for high-capacity network traffic analysis.
    • Cerebellum: A self-hosted management platform running in Kubernetes.
    • Jailer: A process sandboxing tool using eBPF LSM for application isolation.

  5. Overview of Threat Detection

    Threat Detection enriches every incoming request with metadata about its source, including reputation from Gen0Sec feeds, geographic and network origin, and client fingerprints. It does not make autonomous decisions; instead, it provides evidence (fields) that can be used to write WAF rules to determine the action (allow, block, or challenge).

  6. Overview of JA4+ Fingerprint Suite in Synapse

    Synapse implements the JA4+ fingerprinting suite to identify clients, servers, and connections based on protocol behavior rather than just IP addresses. This allows for advanced threat detection, behavioral analysis, and evasion resistance.
    FingerprintLayerSourceAvailable In
    JA4TLSClientHelloProxy
    JA4STLSServerHelloProxy
    JA4HHTTPRequest HeadersProxy
    JA4LNetworkClient-to-Server LatencyBoth
    JA4LSNetworkServer-to-Client LatencyBoth
    JA4TTCPSYN Packet OptionsBoth
    JA4TSTCPSYN-ACK ResponseProxy
    JA4TScanTCPActive TCP ScanBoth
    JA4XTLSX.509 CertificateProxy
    JA4SSHSSHSSH Traffic PatternsBoth
    JA4DDHCPDHCPv4 FingerprintingBoth
    JA4D6DHCPDHCPv6 FingerprintingBoth

  7. Overview of Amygdala Rule Engine

    Amygdala is the rule engine and enforcement layer embedded in every Synapse agent. It automatically converts detected threats (such as bots, credential stuffers, or known-bad fingerprints) into blocking actions. Rules are authored centrally and distributed to agents, which evaluate and enforce them locally against their own traffic.

  8. Overview of Synapse WAF Protection Features

    Synapse WAF provides real-time protection for web applications and APIs. Key capabilities include protection against the OWASP Top 10 (such as Injection, XSS, and Broken Access Control), specialized API security, custom rule creation, and cloud-native deployment with minimal latency.

  9. Overview of Thalamus Intrusion Detection Engine

    Thalamus is the intrusion detection engine integrated into every Gen0Sec sensor and Synapse agent. It is designed to inspect network traffic at wire speed, match it against a user-controlled rule corpus, and emit structured alerts to a SIEM or Cerebellum. It supports both live network traffic and pcap files without sampling.

  10. Overview of Bundler CLI (bundler.sh)

    bundler.sh is a utility provided in the install kit to build an offline bundle on a connected host and load it into a registry on a host without internet access. It uses the release-manifest.yaml from the install kit as its primary input to resolve and fetch the necessary images and charts.

  11. Overview of Synapse Security Event Export

    Synapse uses a unified event model to emit security decisions from multiple layers into a single stream. This eliminates the need to correlate different log formats to determine why a client was blocked. The layers contributing to this stream include:

    • Access rules: Kernel-level address blocks
    • Smart firewall: Fingerprint-driven kernel blocks
    • IDS: Signature matches
    • WAF: HTTP request blocks or challenges
    • Threat intel: Source reputation actions
    • CAPTCHA: Challenges issued or passed
    • Rate limit: Client throttling

  12. Overview of Amygdala rule engine

    Amygdala is the enforcement layer of the Gen0Sec platform. It automatically converts detected threats (from Cortex and Thalamus) into blocking actions. It uses wirefilter for rule definitions and enforces blocks directly in the kernel (via nftables, iptables, or NDIS) to ensure no enforcement happens in userspace on the hot path.