See the whole network.
Every packet accounted for.
Hammerhead is an open network sensor family engineered by Megalodon: Zeek and Suricata detection in parallel, full packet capture for historic forensics, onboard SIEM and AI agents — a hardened stack you can audit, from a branch-office box to a clustered enterprise core.
Three sharks. One stack.
Same hardened software on every model — Rocky Linux base, containerized, orchestrated from Akula or fully standalone. Pick the chassis that matches your traffic, not a different product. The red-badge Hammerhead Firewall line shares the same family.
Mini Hammerhead
Branch offices, labs and small networks — full visibility in a fanless desktop box.
- Monitoring up to 1 Gbps
- Interfaces 2× 1GbE
- Form factor compact · silent
- Deployment standalone
Hammerhead
Purpose-built 1U sensor for organizations up to ~500 concurrent talkers.
- Monitoring up to 10 Gbps
- Interfaces 4× 10GbE SFP+
- Form factor 1U rack
- Deployment standalone
Great Hammerhead
A clustered pair of high-resource nodes for enterprise cores and datacenter east-west traffic.
- Monitoring up to 80 Gbps aggregate
- Interfaces up to 32× 10GbE
- Processing 256 parallel workers
- Deployment active/active cluster
Open stack.
Nothing to take on faith.
Every model runs the same hardened, containerized stack on a Rocky Linux base — Zeek and Suricata, Arkime full packet capture, Graylog SIEM, Wazuh, Velociraptor live forensics and honeypots you can inspect, not a black box you have to trust.
Direct connection to Akula: the whole fleet from a single pane of glass, configuration converging every 10 minutes. Or run any sensor fully standalone.
Talos and Proofpoint ET Pro rulesets, updated continuously across the fleet.
Operate it yourself, or let the Megalodon SOC run it as part of MEG-720.
A SPAN off your core switch — no inline risk, no agents on the wire.
High-speed packet processing across up to 32 × 10GbE interfaces, 256 parallel workers.
Zeek and Suricata in parallel — behavioral analysis and signature detection on every packet.
Arkime indexes every session — complete historic forensic evidence, on demand.
Graylog SIEM, Wazuh and Velociraptor live forensics — investigate on the sensor itself.
An onboard automation platform where AI agents enrich, triage and respond.
Direct connection to Akula — the whole fleet from a single pane of glass, or fully standalone.
See your network the way
we see it.
A guided demo on live traffic, with the engineers who built it — and sizing guidance for your talkers and throughput.