Technical reference

Architecture overview

NodeSight operates as a distributed sensor network deployed at Tor exit relay infrastructure. Each sensor runs a lightweight agent that attaches eBPF programs to the host's network interfaces, capturing and analyzing traffic at kernel level.

The system consists of four layers:

Capture layer — XDP programs attached to NIC drivers extract flow metadata at line rate. AF_XDP sockets deliver zero-copy packet data to userspace via shared memory ring buffers.

Inference layer — A proprietary ensemble architecture processes flow metadata in real time. Protocol-aware tokenization feeds a mixture-of-experts router that activates specialized sub-networks based on traffic characteristics.

Attribution layer — Timing signature correlation against a 14-month circuit database maps anonymous Tor circuits to probable geographic origins with statistical confidence intervals.

Dispatch layer — Structured CEF events are dispatched to customer SIEM platforms via authenticated, encrypted channels.

System requirements

Deployment guide

Standalone deployment

# Install NodeSight sensor
curl -fsSL https://install.nodesight.ai | sh

# Configure sensor nodesight config set --interface eth0 --mode exit-relay nodesight config set --siem-endpoint https://your-siem.example.com/cef nodesight config set --api-key <YOUR_API_KEY>

# Start sensor systemctl enable nodesight-sensor systemctl start nodesight-sensor ```

Air-gapped deployment

For environments without internet access, NodeSight provides an offline installer package that includes all dependencies, model weights, and the circuit database snapshot.

# Transfer the offline package
scp nodesight-offline-v3.2.tar.gz sensor-host:/opt/

# Install cd /opt && tar xzf nodesight-offline-v3.2.tar.gz ./nodesight-offline/install.sh ```

API reference

CEF event format

All NodeSight alerts are delivered as CEF (Common Event Format) events:

CEF:0|NodeSight|TorThreat|3.2|100|Anomalous Exfiltration|9|
  src=198.96.155.3
  dst=10.0.0.45
  spt=443
  dpt=9001
  cs1Label=ThreatType cs1=credential_exfiltration
  cs2Label=Confidence cs2=0.947
  cs3Label=Attribution cs3=Frankfurt,DE
  cn1Label=FlowBytes cn1=2847392
  deviceCustomDate1Label=FirstSeen deviceCustomDate1=2025-06-15T12:04:22Z

REST API

# Query recent alerts
GET /api/v1/alerts?since=2025-06-15T00:00:00Z&severity=critical
Authorization: Bearer <API_KEY>

# Get alert details GET /api/v1/alerts/{alert_id} Authorization: Bearer <API_KEY>

# Configure monitoring rules POST /api/v1/rules Authorization: Bearer <API_KEY> Content-Type: application/json

{ "name": "credential-monitoring", "type": "pattern", "domains": ["example.com", "*.example.com"], "severity_threshold": "high" } ```

SIEM integration

Splunk

Configure a new HTTP Event Collector (HEC) input and point NodeSight to the HEC endpoint:

nodesight config set --siem-type splunk
nodesight config set --siem-endpoint https://splunk.example.com:8088/services/collector
nodesight config set --siem-token <HEC_TOKEN>

Microsoft Sentinel

Use the NodeSight Data Connector from the Sentinel Content Hub, or configure direct CEF forwarding via the Log Analytics agent.

IBM QRadar

Configure a new log source with protocol "Syslog" and format "CEF". NodeSight will forward events to the QRadar console on the configured port.

Elastic SIEM

Use the Logstash CEF input plugin or configure direct webhook delivery to an Elasticsearch index.