The same packets. Radically different output.
Each comparison below is drawn from an independently verified, hash-checked benchmark: an identical capture replayed through Suricata→SIEM and through Suricata→Cernity→SIEM. Only Cernity is added.
Periodic C2 callback 10.0.0.5 → 203.0.113.66:443
Suricata alone
- flow records
- 20
- threat alerts
- 0
17 flow rows for the host, 0 alerts — nothing flagged
+ Cernity
- category
- c2
- detector
- beacon
- ATT&CK
- T1071
- severity
- 8
- interval
- 5s (jitter 0s)
- connections
- 20
one C2-beacon finding with the measured cadence
Suricata logged the callbacks but raised no alert. Cernity derived the 5-second cadence and named it C2.
Internal fan-out 172.31.0.5 → 12 internal hosts
Suricata alone
- flow records
- 48
- threat alerts
- 0
48 flow rows, 0 alerts — connections scattered, unlinked
+ Cernity
- category
- lateral
- detectors
- lateral_movement, rdp_fanout
- targets
- 12
one administrative-port fan-out lead
The analyst would have to aggregate 48 connections by hand. Cernity delivered the fan-out as a single lead.
Repeated signature, consolidated 203.0.113.5 → 203.0.113.10:4444
Suricata alone
- threat alerts
- 45
- classification
- A Network Trojan was detected
45 repeating alert records for one incident
+ Cernity
- category
- c2
- ATT&CK
- T1071
- findings
- 1 (was 45 alerts)
one stable finding identity (2 revisions)
Here Suricata does classify the threat — and fires it 45 times. Cernity keeps it as one tracked incident.
Distributed low-and-slow transfer 10.0.0.15 → 203.0.113.200
Suricata alone
- flow records
- 11
- threat alerts
- 44
- naming the threat
- 0
44 TCP stream-anomaly alerts on the pair — none says 'exfil'
+ Cernity
- category
- exfil
- detector
- low_slow_exfil
- ATT&CK
- TA0010
- severity
- 6
- connections
- 11
- bytes
- 5,933,840
one data-exfiltration lead: 5.93 MB across 11 flows
Suricata's alerts were protocol noise, not a data-theft signal. Cernity summed the transfer and tagged exfiltration.
Honest limits
- Cernity is not free of false leads: on a benign transfer in the same test its beacon detector raised two c2 leads that were not malicious.
- These are synthetic, single-host scenarios that demonstrate the mechanism — not a population precision/recall study.
- On threats Suricata already signatures, both catch it; Cernity's edge there is consolidation and enrichment.
- No analyst-workload or resource-cost figure is claimed here.
These figures are derived from a verified evidence package retained privately. The claims here are deliberately bounded to what those records support. The product is open source — read the code and the benchmark harness on GitHub ↗.