Trisul Terminology
Trisul Network Analytics uses a set of terms to describe how traffic is captured, analyzed, stored, and investigated.
Detailed individual counter groups, trackers, and alert types are documented in the dedicated pages of respective topics.
This page focuses on the shared terminology used across them.
The Glossary defines networking, security, and ISP terms. This page covers the terms Trisul uses.
How to Read This Page
Trisul terminology is grouped by conceptual layers, starting from how the system runs, moving through traffic and analytics, and ending with how you interact with the data.
You do not need to memorize these terms. The goal is to make them familiar when you encounter them elsewhere in the UI or documentation.
1. Architecture & Runtime Terminology
These terms describe how Trisul is set up and how its parts work together.
Node
A node is any machine where a Trisul component is installed and running.
A node can run the Probe component, the Hub component, or both, depending on how Trisul is deployed. Probe nodes primarily analyze traffic, while Hub nodes primarily store and serve the analyzed data.
You will encounter this term when installing Trisul or working with deployments that use multiple machines.
Probe
A Probe is a Trisul node that analyzes network traffic.
It receives packets or flow records, processes them, and produces metrics, flows, and alerts. When you view live traffic information or real-time alerts in WebTrisul, the traffic was first processed by a Probe.
Hub
A Hub is a Trisul node that stores and provides access to data generated by Probes.
Probes send their analyzed results to the Hub. The Hub stores this data and provides it when you open dashboards, charts, or searches.
In simple terms:
- Probe analyzes the traffic.
- Hub stores the results and serves them when you need to view or search them.
WebTrisul
WebTrisul is the web-based interface you access in your browser.
It is where you log in to Trisul, view dashboards, explore traffic, investigate alerts, search flows, and manage users.
If you are interacting with Trisul through a web browser, you are using WebTrisul.
Domain
A domain is the top-level administrative boundary in a Trisul deployment.
It groups the Trisul components that belong to the same deployment and establishes the trust relationship between them.
For example, a deployment may contain several Probes and Hubs that communicate with each other within the same domain.
In most deployments, the domain is created during installation and does not require regular user interaction. You are more likely to encounter the term when working with certificates, distributed deployments, or advanced administration.
See also: Domains.
Context
A context is a separate monitoring workspace inside Trisul.
When you select a context in the UI, you are choosing which traffic data, dashboards, alerts, and configuration you are working with. Each context keeps its data and configuration separate from other contexts.
Contexts are useful when you want to monitor different networks or environments separately.
For example, you could have:
- one context for a production network
- another context for a test network
- separate contexts for different customers
Each context can be started, stopped, reset, or deleted independently.
See also: Working With Contexts.
Think of a Context as an office and a Profile as the office's setup blueprint.
A Context is the actual office you are working in. It has its own data, dashboards, alerts, and configuration. Two offices can operate independently even though they belong to the same organization.
A Profile is the blueprint for setting up an office. It defines what equipment and arrangements the office should have, so you don't have to configure every office from scratch.
For example:
Imagine you operate two offices, one for Production and one for Testing.
You create a Production Context and a Test Context. Each context has its own traffic data and can be managed independently.
Both offices need the same setup: the same monitoring equipment, measurements, flow tracking, and alerts. Instead of configuring both contexts separately, you use the same Profile for both.
If you create another context with the same requirements, you can assign the same profile to it.
Profile
A profile is the configuration used by a context to decide how traffic is analyzed.
It controls capture settings such as interfaces and filters, the counters that are measured, flow tracking, alerts, resources, and other analytics options.
You assign a profile to a context from the CLI. That profile defines:
- which counters are available
- which alerts are enabled
- how flows are tracked
If you want another context to use the same setup, you can reuse or duplicate the profile instead of configuring everything again.
In simple terms, a profile lets you reuse the same monitoring setup across contexts.
GUID
A GUID is a globally unique identifier used by Trisul to uniquely identify internal objects.
GUIDs are used to distinguish things like counter groups, trackers, alerts, or configuration objects from one another, even if they have the same name.
Trisul generates GUIDs automatically. You will mainly encounter them when working with configuration files, APIs, exports, or troubleshooting.
See also: GUID reference.
Machine ID
A Machine ID is a unique identifier assigned to a specific system where Trisul is installed.
It helps Trisul identify the machine for purposes such as licensing, deployment identity, and internal coordination.
In simple terms, the Machine ID answers:
“Which machine is this Trisul installation running on?”
The Machine ID is tied to the system and is not intended to be manually changed or reused on another machine.
Flush Time
Flush Time is the time Trisul takes to collect the latest streaming data and send a snapshot of that data to Trisul-Hub.
It is a measure of how quickly the Probe can prepare and hand over its latest results to the Hub.
You will mainly encounter Flush Time when looking at Trisul system performance.
IOP (Input/Output Operation)
IOP (Input/Output Operation) is a read or write operation performed on a storage device.
For example, reading data from a disk and writing data to a disk are both input/output operations.
IOP is useful when looking at storage performance because a system that performs many read/write operations can place a higher workload on its storage devices.
2. Deployment & Mode-Specific Terminology
These terms describe how Trisul is deployed and what type of traffic data it processes.
Packet Capture Mode
Packet mode analyzes traffic using captured network packets.
Packet capture mode is a processing mode, not a product mode. See Processing Mode.
In this mode, Trisul works directly with packet data, allowing inspection at the protocol and payload level.
Packet mode provides detailed visibility into the traffic because Trisul can work with the actual packets rather than only with summaries of the traffic.
Flow-Based Mode
Flow mode is a processing mode where Trisul analyzes traffic using flow records exported by network devices instead of captured packets.
Flow records contain summaries of network conversations rather than the original packets.
The information available in Trisul therefore depends on what fields are included in the received flow records.
Home Network
In Trisul, home network means the network that you have configured as your own or monitored network.
The term home network does not mean that Trisul is only used for a home or residential network. It can refer to an organization's network, a data center network, a campus network, or any other network that you are monitoring.
For example, if Trisul is monitoring a company's network, the company's computers, servers, phones, and other network devices belong to the home network.
This definition is important because Trisul uses the home network to determine whether traffic is inbound, outbound, or transit.
By default, Trisul treats the RFC 1918 private ranges 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as the home network.
See also: Home Network Concepts. To add or edit home networks, see Home Networks.
Internal Hosts
Internal Hosts are hosts that belong to your home network.
For example, they can include:
- Employee computers
- Laptops
- Mobile phones
- Servers
- Printers
- Network devices
- Other devices connected to your network
When a Trisul dashboard shows Internal Hosts, it is referring to devices that belong to the network you are monitoring.
Inbound / Outbound / Transit Traffic
Traffic direction is determined relative to the home network:
- Inbound traffic enters the home network.
- Outbound traffic leaves the home network.
- Transit traffic passes through the network without originating or terminating inside it.
- Internal traffic stays inside the home network. Both the source and the destination are home-network addresses.
For example, if a computer inside your network downloads data from an Internet server, the traffic entering your network is inbound.
If a computer inside your network sends data to an Internet server, the traffic leaving your network is outbound.
This classification is used throughout Trisul to group and report traffic by direction.
The UI uses both sets of direction labels: Inbound or Incoming, and Outbound or Outgoing.
Upload
Upload refers to data being transferred out of your network to an external destination.
For example, when a computer in your network sends a file to an Internet service, that data transfer is an upload.
Download
Download refers to data being transferred into your network from an external destination.
For example, when a computer in your network receives a file from an Internet service, that data transfer is a download.
External Hosts
External hosts are systems outside your home network.
These may include:
- Websites
- Internet servers
- Cloud services
- Remote servers
- Other systems communicating with your network
For example, when a computer on your network accesses a website, your computer is an internal host and the web server it communicates with is an external host.
3. Traffic & Flow Model Terminology
These terms describe what Trisul observes on the network.
Packet
A packet is a single unit of network data captured from the wire.
Packet-level visibility is mainly used in packet capture mode and allows detailed inspection and forensic analysis.
PCAP (Packet Capture)
PCAP (Packet Capture) refers to captured raw network packets that can be stored for later analysis.
A PCAP contains the actual packets observed on the network rather than only a summary of the communication.
PCAP data can therefore be used when you need to examine traffic at the packet level.
Dropped Packet
A Dropped Packet is a packet that was not successfully processed by the packet capture or processing pipeline.
Dropped packets are important because they can indicate that Trisul was unable to keep up with the traffic being received.
The System Performance dashboard can help you see whether packets are being dropped.
Flow
A flow represents a network conversation between endpoints.
Instead of storing every packet as a separate item for flow analysis, Trisul summarizes the communication into a flow using information such as:
- source and destination addresses
- ports
- protocol
- amount of data
- number of packets
- duration
For example, when a computer accesses a website, the communication between the computer and the web server can be represented as a flow.
Flows make it practical to analyze large volumes of network traffic without examining every packet individually.
IP Flow
An IP Flow is a flow identified at the IP layer between communicating endpoints.
It represents communication between IP addresses and can be used to understand which systems are exchanging traffic and how much traffic they exchange.
Long-Lived Flow
A Long-Lived Flow is a network flow that remains active for a long period of time.
A long-lived flow does not necessarily transfer a large amount of data. A connection can stay open for a long time while transferring relatively little data.
This is useful when looking for connections that remain active for an unusually long period.
TCP Payload
TCP Payload is the actual application data carried inside a TCP connection.
It does not include the additional TCP information used to transport that data.
For example, when a TCP connection transfers a file, the file data is part of the TCP payload, while TCP headers used to manage the connection are not.
TCP payload is useful when you want to measure the amount of actual data transferred rather than the total traffic generated by the TCP connection.
Flow Record
A flow record is the stored form of a flow.
It contains information such as timestamps, counters, and attributes that describe the network conversation.
Flow records are what you search, filter, and analyze in flow investigation tools.
Application
An application identifies the type of network service associated with traffic.
For example:
- HTTP and HTTPS are commonly associated with web traffic.
- SSH is commonly associated with remote access.
- DNS is commonly associated with domain-name lookups.
Trisul identifies applications in network traffic and groups traffic by application. This allows you to see how much traffic each application generates and how frequently it is used.
Bi-directional Flow
A bi-directional flow includes traffic in both directions between two endpoints and represents a complete conversation.
This is how Trisul typically shows flows when it can see both sides of the exchange. Bytes, packets, and duration reflect the complete back-and-forth, making it easier to understand who talked to whom and how much data was exchanged overall.
For most users, this is the default and most intuitive view of network traffic.
Uni-directional Flow
A uni-directional flow represents traffic observed in only one direction.
This occurs when the traffic source or capture point reports each direction separately, or when only one direction of the traffic is visible at the observation point.
In such cases, Trisul records exactly what it sees.
As a result, a single network conversation may appear as two separate flows, one for each direction. This is expected behavior and reflects how the traffic was observed, not a duplication or error in analysis.
Observation Point
An observation point is where Trisul sees the network traffic.
It could be:
- a physical network interface
- a router
- a firewall
- a traffic tap
- a SPAN port
- a flow exporter
Knowing the observation point helps you understand where the traffic data was collected in the network.
4. Analytics & Counters Terminology
These terms describe how Trisul measures and summarizes traffic.
Counter Group
A counter group defines a category of things that Trisul measures.
Each counter group groups together similar items, such as hosts, applications, interfaces, or autonomous systems.
Counter groups exist so Trisul knows what type of entities it is analyzing.
Each counter group has its own set of measurements and its own dedicated documentation page.
Key
A key represents a single thing being measured within a counter group.
You can think of a key as the item Trisul is tracking inside a counter group.
For example:
- an IP address is a key in the Hosts counter group
- an application name is a key in the Apps counter group
When you see toppers, charts, or tables, you are often seeing keys ranked by their metrics.
-
Counter Group is a group that tracks the same type of information. Each value tracked within the group is a key.
For example:
-
Apps is a counter group that tracks application names.
https,http, andimapare keys within the Apps counter group. -
Hosts is a counter group that tracks individual hosts. For example,
192.168.1.10and10.0.0.5are keys within the Hosts counter group. -
Country is a counter group that tracks individual countries. For example,
United States,India, andChinaare keys within the Country counter group. -
ASN is a counter group that tracks individual AS numbers. For example,
15169and3356are keys within the ASN counter group.
-
Meter
A meter defines what Trisul measures for each key.
Examples include:
- bytes
- packets
- flows
- errors
A counter group can have multiple meters, with each meter measuring a different aspect of traffic.
Metric
A metric is the numeric value produced by a meter over a period of time.
Metrics are the actual numbers you see on charts, use in alerts, and export in reports.
Example:
Meter: Total Bytes
Metric: 1.2 GB at 10:05
Packets Wire
Packets Wire is the number of packets seen per minute by the packet capture mechanism.
It helps you understand how much packet traffic the Probe is receiving from the network.
Bandwidth
Bandwidth is the rate at which data is being transferred.
It is displayed as a rate such as Kbps or Mbps.
For example, if a dashboard shows 100 Mbps, it means the network is currently transferring data at a rate of approximately 100 megabits per second.
In
In is the amount of data received by the network during the selected time period.
In Trisul dashboards, it normally refers to traffic entering the monitored home network.
Out
Out is the amount of data sent from the network during the selected time period.
In Trisul dashboards, it normally refers to traffic leaving the monitored home network.
Active Flows
Active Flows is the number of network flows that are currently active.
It gives you an idea of how many network conversations are taking place at the same time.
For example, a high number of active flows can mean that many devices or applications are communicating simultaneously.
Active Internal IPs
Active Internal IPs is the number of internal IP addresses that are currently active.
It tells you approximately how many devices or systems inside your monitored network are participating in network activity during the selected period.
Top Hosts
Top Hosts are the hosts associated with the highest traffic rates.
A Top Hosts view helps you quickly identify which devices or systems are generating the most network traffic.
Top Apps
Top Apps are the applications associated with the highest traffic rates.
A Top Apps view helps you quickly identify which applications are responsible for the most network traffic.
Data Volume
Data Volume is the total amount of data transferred during the selected time period.
It is displayed as a data size such as MB or GB.
For example, if a dashboard shows 5 GB of Data Volume, it means 5 GB of data was transferred during the selected period.
Topper / Top-N
A topper shows you the highest-ranking keys for a selected metric and time range.
Instead of looking through every host, application, or other key, a topper shows the items that rank highest.
For example:
- Which hosts used the most bandwidth?
- Which applications generated the most traffic?
- Which ASNs carried the most traffic?
Toppers are useful when you want to quickly find the largest contributors to network activity.
Cardinality
Cardinality tells you how many different keys were active in a counter group during a given time period.
For example:
- How many different hosts communicated on the network?
- How many unique applications were seen?
- How many ASNs contributed traffic?
Cardinality is about the number of different participants, not the amount of traffic they generated.
For example, a network could have:
- high traffic generated by a small number of hosts, or
- moderate traffic generated by a very large number of hosts.
Cardinality helps you distinguish between these situations.
Hi Water
Hi Water is the upper threshold used to indicate that a monitored value has reached a specified high level.
When a value reaches or exceeds the Hi Water level, the feature using the threshold can take the configured action or indicate that the high threshold has been crossed.
The meaning of the Hi Water value depends on what is being monitored. It can be used with metrics such as traffic volume, bandwidth, number of active keys, and other measurements.
Low Water
Low Water is the lower threshold used to indicate that a monitored value has fallen to a specified low level.
When a value reaches or falls below the Low Water level, the feature using the threshold can take the configured action or indicate that the low threshold has been crossed.
The meaning of the Low Water value depends on what is being monitored. It can be used with metrics such as traffic volume, bandwidth, number of active keys, and other measurements.
CPU Usage
CPU Usage shows how much of the system's processing capacity is being used by the operating system and Trisul Probe.
A high CPU usage value means the system is using a large part of its available processing capacity.
CPU Usage is a system performance measurement, not a measure of network traffic.
Memory Usage
Memory Usage shows how much system memory is being used by the operating system and Trisul Probe.
It helps you understand how much of the machine's available memory is currently being used.
Memory Usage is a system performance measurement, not a measure of network traffic.
PCAP Disk Bandwidth
PCAP Disk Bandwidth is the rate at which raw packet capture data is written to disk.
It helps you understand how much disk activity is being generated by packet capture.
Front End
Front End refers to the streaming pipeline or engine through which network packets are received and processed.
5. Time, Storage & Retention Terminology
These terms explain how data is stored and managed over time.
Time Bucket
A time bucket is the time interval Trisul uses to group metric values together.
For example, Trisul may group values into one-minute or five-minute intervals.
Instead of storing every individual measurement separately, Trisul stores data for each time interval as a group.
When you look at a chart, each point or bar can represent one of these time buckets.
Resolution
Resolution describes how much detail Trisul keeps when storing and displaying data.
At higher resolution, data is stored in smaller time buckets, so charts can show finer detail.
At lower resolution, data is stored in larger time buckets, so charts contain less detail but can cover longer periods more efficiently.
In simple terms:
- Higher resolution = more detail
- Lower resolution = less detail over a longer period
Retention
Retention defines how long Trisul keeps stored data.
Different types of data can have different retention periods.
For example, recent data may be available in greater detail, while older data may be stored at lower detail or eventually removed.
Retention settings therefore determine how far back you can go when looking at historical data.
Oper / Ref / Archive
Oper, Ref, and Archive are the three storage tiers Trisul uses to store flow data as it ages.
-
New flow data is stored in Oper. This tier holds recent data and is optimized for fast access.
-
As Oper fills, the oldest data moves into Ref automatically.
-
As Ref fills, the oldest data moves into Archive. Archive storage is intended for historical lookups rather than frequent interactive analysis.
Trisul does not summarize or roll up data in any tier, including Ref and Archive. Older data keeps its full detail until it ages out of Archive.
Slice
A slice is the basic storage unit Trisul uses to store traffic data on disk.
Instead of storing all data in one continuously growing file, Trisul breaks the data into slices.
Each slice contains a portion of data for a period of time. This makes it easier for Trisul to move, retain, or delete data as it becomes older.
You normally do not work with slices directly, but they are important for understanding how Trisul manages storage and retention.
SlicePolicy
SlicePolicy defines how Trisul manages stored slices as they become older.
It controls things such as:
- how many slices are kept in Oper, Ref, and Archive storage
- when slices move from one storage tier to another
- when slices are finally deleted
In simple terms, SlicePolicy determines how Trisul's stored data ages and is eventually removed.
6. UI & Investigation Terminology
These terms describe how Trisul presents data and how users navigate through it after data has been collected.
Dashboard
A dashboard is a saved layout that displays selected charts, tables, and indicators.
A dashboard defines what is shown and how it is arranged, but it does not change how data is collected or analyzed.
Dashboards can be opened repeatedly to view the same set of analytics over different time ranges.
Modules
A module is a self-contained analysis block inside a dashboard.
Each module focuses on a particular type of analysis and presents related charts, tables, or other views.
A dashboard is made up of one or more modules arranged in a layout.
In simple terms:
Dashboard = the complete page
Module = one analysis section on that page
Module Template
A module template defines the structure and default configuration of a module.
It specifies:
- which views appear in the module
- how those views are arranged
- the default parameters those views use, such as metrics, groupings, or scopes
A module template controls how a module is constructed and initialized. It does not affect how traffic is captured or processed.
Key Dashboard
A key dashboard is a dashboard automatically scoped to one specific key.
For example, if the key is a particular host, the dashboard shows information related to that host.
The same idea can be used for other entities such as an application or ASN.
The important point is that the dashboard is already focused on that one entity, so you do not have to manually filter every module.
Flow Tagger
A flow tagger applies labels to flows based on configured rules.
These labels are stored as attributes of the flow record and can then be used in flow searches, aggregation, alerts, and reports.
Flow tagging does not change the original flow. It adds information that makes the flow easier to classify and find later.
Stabber
A stabber is a view that continuously updates as new data arrives.
Unlike a historical view, a real-time stabber keeps refreshing so that you can see current traffic, counters, or alerts as they are produced.
Stabbers are commonly used when you want to watch what is happening on the network right now.
Real Time
Real Time means that the dashboard receives and displays current network activity as it happens, rather than relying only on previously stored historical data.
A real-time view keeps updating as new network activity is processed.
Drill-down
Drill-down is the act of moving from a high-level view to a more detailed view of the same data.
For example, you might start by looking at total network traffic, then select a particular host, and then examine the flows associated with that host.
Each drill-down step gives you more detail about the activity you are investigating.
PCAP Drilldown
A PCAP drilldown allows you to move from higher-level traffic information to the underlying captured packets.
For example, you may start with a flow and then drill down to the packets that make up that flow.
This provides packet-level visibility for detailed investigation.
PCAP drilldown is available only when packet capture is enabled and the required packet data has been retained.
Pivot
A pivot changes how the same underlying data is grouped or viewed.
For example, the same alert activity could be viewed by:
- Signature
- Priority
- Classification
- Source IP
- Destination IP
- Port
Pivoting changes the perspective you use to examine the data. It does not change the underlying data itself.
Live Mode
Live mode shows analytics results as they are produced in real time.
Data updates continuously as traffic is processed.
Live mode is used when you want to see the current state of the network rather than review what happened earlier.
Historical Mode
Historical mode displays analytics results that have already been computed and stored.
It allows you to select a past time range and review the metrics, flows, and alerts that Trisul recorded during that period.
Unlike Live Mode, Historical Mode does not continuously update with new network activity.
7. Analytics Execution
These terms describe how and when analytics logic is applied to traffic data, not how data is visualized or stored.
Sliding Window
A sliding window is a moving time range that Trisul continuously evaluates.
For example, if a feature uses a five-minute sliding window, Trisul looks at the most recent five minutes of data. As time moves forward, new data enters the window and older data leaves it.
This is useful for answering questions such as:
- What has been happening recently?
- Is traffic increasing right now?
- Has activity remained high during the last few minutes?
Sliding windows are commonly used in real-time charts, alerts, and anomaly detection.
Retro Analysis
Retro analysis is analysis of a past time window.
You pick a time range that has already passed, and Trisul analyzes the data it stored for that window.
See also: Retro analysis in the User Guide.
8. Detection, Alerts and Monitoring Terminology
These terms describe how Trisul flags important events, evaluates traffic, and focuses monitoring on specific entities.
Alert
An alert is a recorded event generated when a configured detection condition in Trisul is met.
An alert can be generated by mechanisms such as:
- a threshold check
- an anomaly detector
- a flow tracker condition
- an external IDS engine
An alert records information such as when the event occurred, what generated it, and the metric, key, or flow associated with it.
In practical terms, alerts answer:
“Which detection conditions were met, and when?”
Threshold Crossing Alert
A threshold crossing alert is generated when a metric crosses a configured threshold value.
The threshold can be an upper limit, a lower limit, or both.
For example, you could configure a threshold for traffic volume. If the traffic rises above that configured value, Trisul can generate an alert.
Threshold crossing alerts are based on fixed configured conditions rather than learned behavior.
Anomaly Alert
An anomaly alert is generated when a metric behaves differently from its learned normal pattern.
Trisul can learn what normal behavior looks like for a metric over time. If the current value differs significantly from that expected behavior, Trisul can generate an anomaly alert.
Unlike a threshold crossing alert, an anomaly alert does not require you to define one fixed limit such as “alert when traffic exceeds 1 GB.”
Flow Tracker Alert
A flow tracker alert is generated when a network flow matches the conditions configured in a flow tracker.
A flow tracker can evaluate characteristics of individual flows, such as:
- size
- duration
- rate
- other flow attributes
When a flow satisfies the configured conditions, Trisul records an alert for that flow.
Blacklist
Blacklist refers to alerts associated with activity involving known blacklisted or suspicious entities.
For example, a blacklist alert may indicate that network activity involved an IP address or other indicator that appears in a configured threat intelligence source.
In dashboards, the Blacklist value can show the number of alerts associated with such activity.
IDS Alert
An IDS alert is an alert generated by an external Intrusion Detection System (IDS) and ingested by Trisul.
The IDS engine performs the detection using its own rules and signatures. Trisul records the alert and provides additional traffic, flow, and metric information that can help you investigate it.
In other words:
The IDS detects the activity; Trisul provides visibility and context for investigating it.
Raw Alert
A Raw Alert is an individual IDS alert as it is received.
It represents one specific alert event rather than a summary of multiple alerts.
Raw alerts are useful when you need to examine individual alert events and their details.
Aggregated Alert
An Aggregated Alert is a group of related IDS alerts presented together as a summary.
Instead of viewing every alert individually, aggregation lets you see the overall activity for a particular group, such as alerts of the same type.
This is useful when many similar alerts are generated and you want to understand the overall pattern before examining individual alerts.
Signature
A Signature identifies the particular type of activity or detection rule associated with an IDS alert.
For example, an IDS can have different signatures for different types of suspicious activity.
Looking at the signature helps you understand what the IDS believes it detected.
Priority
Priority indicates the priority assigned to an IDS alert.
It helps you distinguish alerts that require more attention from those considered less important.
For example, a real-time alert view may group alerts by priority so that higher-priority activity is easier to notice.
Classification
Classification describes the category assigned to an IDS alert.
It helps group similar alerts based on the type of activity detected.
For example, classifications can help distinguish different categories of suspicious network behavior.
Source IP
Source IP identifies the IP address from which the network activity associated with an alert originated.
For example, if a device at 192.168.1.10 sends traffic that triggers an IDS alert, 192.168.1.10 may appear as the Source IP.
Destination IP
Destination IP identifies the IP address that received the network activity associated with an alert.
For example, if a device sends suspicious traffic to 10.10.10.20, that address may appear as the Destination IP.
Alert Severity
Alert severity is a classification attached to an alert that indicates how important the alert is considered.
It helps users prioritize which alerts should receive attention first.
Severity is used to organize and prioritize alerts. It does not determine whether the underlying detection condition is true.
Custom Key Monitors
A custom key monitor lets you specifically monitor selected keys instead of monitoring every key in a counter group.
For example, you can focus monitoring on particular hosts, applications, or other entities that are important to you.
This is useful when you want dedicated monitoring or alerting for specific entities.
9. Graph & Visualization Terminology
These terms describe visual representations used in Trisul to explore relationships, flows, and patterns in traffic data.
They focus on how data is visualized, not how it is collected, stored, or analyzed.
Edge
An edge is a line in a graph that represents a relationship between two entities.
In Trisul traffic graphs, an edge can represent communication between two entities, such as two IP addresses.
For example, if Host A communicates with Host B, the graph may show an edge connecting them.
The edge can carry traffic information and can be selected to investigate the traffic or flows represented by that relationship.
Sankey Drilldown
A Sankey drilldown is a graphical view that shows how traffic moves between different entities as connected paths.
The width of a path represents the amount of traffic flowing through it.
For example, a Sankey view can help you follow traffic from one group of entities to another and then drill into more specific categories.
It is useful when you want to understand where traffic is coming from, where it is going, and how it is distributed.
Multigraph
A multigraph is a graph where the same two entities can have more than one connection shown between them.
This can happen when traffic between the same entities needs to be separated based on attributes such as:
- direction
- protocol
- application
- interface
Instead of combining all of that traffic into one connection, a multigraph can show the different relationships separately.
Parallel Coordinates
Parallel coordinates is a visualization used to compare multiple attributes of several entities or flows at the same time.
Each vertical axis represents a different attribute or metric, and each line represents an entity or flow.
This makes it easier to spot patterns, relationships, and unusual values that may not be obvious when looking at one metric at a time.
10. ISP / IPDR-Specific Terminology
These terms appear in Trisul ISP Analytics and Trisul IPDR DoT Compliance Solution deployments. They don't apply to Trisul NetFlow Analyzer.
They describe concepts that do not apply to generic enterprise monitoring and must be understood in this context.
ASN Peering
ASN peering refers to traffic exchanged between autonomous systems.
An autonomous system, or AS, represents a network under a common routing policy.
In Trisul, ASN peering analysis groups traffic by source and destination ASNs. This helps you understand how much traffic is exchanged between different networks.
Upstream / Downstream
Upstream and downstream describe traffic direction from the point of view of a service provider.
- Upstream traffic flows toward providers or higher-level networks.
- Downstream traffic flows toward customers or lower-level networks.
These terms are commonly used in ISP environments instead of describing traffic as inbound or outbound.
Transit Traffic
Transit traffic is traffic that passes through a network without originating or terminating within that network.
For example, a service provider may carry traffic between two other networks without either endpoint belonging to that provider.
Transit traffic is particularly important in ISP environments because it consumes network capacity even though the traffic is not directly destined for the provider's own customers.
Subscriber IP
A subscriber IP identifies the IP address associated with a customer or subscriber in an ISP or broadband network.
Subscriber IPs allow traffic and flow records to be associated with customers rather than only with network devices or infrastructure.
NAT Correlation
NAT correlation allows Trisul to associate translated network traffic with the original subscriber or source.
Network Address Translation (NAT) can cause many customers or devices to appear on the outside of the network using the same public IP address.
NAT correlation uses information such as translated addresses and ports to help determine which subscriber was responsible for a particular connection.
Compliance Window
A compliance window defines the time period for which data must be retained and made available to meet a compliance requirement.
For example, regulations may require certain IPDR information to remain available for a specified period.
A compliance window is therefore driven by regulatory requirements rather than by normal operational or analytical needs.
DoT Strict Format
DoT strict format refers to the specific structure and field definitions required by the Department of Telecommunications (DoT) for IPDR records.
When DoT strict format is enabled, IPDR records are generated according to the format required for regulatory compliance.
This includes requirements such as the expected fields and structure of the records.
11. Deployment, Reliability & Operations Terminology
These terms describe how Trisul is installed, deployed, and operated, rather than how traffic is analyzed or visualized.
DC/DR
DC stands for Data Center and refers to the primary Trisul deployment where traffic is processed and stored.
DR stands for Disaster Recovery and refers to a secondary deployment maintained for continuity.
A DR deployment is used so that Trisul services and data can continue to be available if the primary deployment becomes unavailable.
Adapter
A capture adapter is a network interface that a Probe listens on to capture packets.
Each profile has its own list of capture adapters. You enable the interfaces you want Trisul to monitor, for example eth1.
See also: Capture Adapters.
Access Point
An access point maps a protocol to a port or other identifier, so Trisul knows how to decode the traffic it receives.
For example, you can map UDP port 5556 to the NetFlow protocol. Trisul then decodes packets sent to that port as NetFlow records.
See also: Access Points.
Package
A package is an installable Trisul software bundle.
A package contains a specific set of Trisul components or supporting software that can be installed on a node.
Product Mode
A product mode defines which Trisul solution and capabilities are active in a deployment.
It determines the type of data Trisul expects, the features that are available, and the way results are organized.
Changing the product mode therefore changes what Trisul is intended to do in that deployment, not only how the UI looks.
See also: Product Modes.
Processing Mode
A processing mode defines the type of input data Trisul processes.
For example, Trisul can process packet data or flow data depending on the deployment.
The processing mode affects the type and level of visibility available because packet data contains different information from summarized flow records.
12. Automation and Workflows Terminology
Cron Task
A cron task is a scheduled job that runs automatically at a specified time or interval.
Cron tasks can be used for recurring operations such as:
- report generation
- data export
- backups
- maintenance
A cron task determines when an operation runs, rather than what the operation itself does.
See also: Cron Tasks.
Task
A task represents a defined workflow or operation within Trisul.
It can group related steps that need to be performed as part of a particular workflow.
A task describes what work needs to be carried out, while scheduling mechanisms determine when that work runs.
13. Plugins and Enrichments Terminology
These terms describe extensions that add additional context, intelligence, or detection to Trisul's core analytics.
Plugin
A plugin extends Trisul with additional functionality.
Plugins can add capabilities such as:
- analytics
- enrichment
- detection
- external intelligence
They work with Trisul's processing pipeline without requiring changes to the core Trisul components.
Badfellas
Badfellas is a threat intelligence plugin.
It identifies traffic associated with known malicious indicators using external intelligence sources.
This allows Trisul to provide additional context when network activity involves known suspicious or malicious entities.
Geo
The Geo plugin enriches traffic data with geographic information.
It maps IP addresses to geographic locations so that traffic can be analyzed or displayed based on location.
Resolve
The Resolve plugin performs name resolution for IP addresses.
It can map IP addresses to hostnames or domain names, making traffic information easier to read and understand.
SNMP Resolve
SNMP Resolve enriches data using SNMP information.
It can map identifiers such as interfaces or devices to meaningful names obtained through SNMP polling.
14. Users, Access & Auditing Terminology
These terms describe who can access Trisul, what they are allowed to see or do, and how user activity is recorded.
User
A user is an account that can log in to Trisul.
Users access WebTrisul and perform actions based on the permissions assigned to them.
Role
A role defines a set of permissions that controls what a user can access or do in Trisul.
Roles can determine access to contexts, views, tools, and administrative functions.
A user can be assigned a role so that permissions do not have to be configured individually for every action.
See also: Roles.
Webserver Logs
Webserver logs record activity related to the Trisul web interface.
They can contain information about requests and access to WebTrisul and are useful for troubleshooting and auditing.
Auth Log
The authentication log records login and authentication-related events.
It can include information about login attempts, successful logins, failed logins, and other authentication activity.
See also: Auth Log.