Visibility · Control · Detection and response
Your network, always in sight.
Corvane is one platform to monitor, manage and defend your network. A physical or virtual appliance at each site, one outbound connection to the console, and every device, link, flow and threat in one place.
One platform, three jobs
See it, change it, defend it. From the same console.
Most teams run one tool to watch the network, another to back up and change configurations, and a third to catch threats. Corvane does all three from one appliance per site and one console, so the alert, the evidence and the fix sit side by side.
Latency · Frankfurt SD-WAN link · 24 h Above SLA at 02:40
Top applications by volume NetFlow · IPFIX · 1 h
| Site | Link | Latency | Loss | Jitter | Status |
|---|---|---|---|---|---|
| Frankfurt | SD-WAN | 58 ms | 4.8 % | 11 ms | Critical |
| Singapore | MPLS | 41 ms | 0.9 % | 6 ms | Warning |
| Montréal HQ | Fibre | 4 ms | 0.0 % | 1 ms | Online |
| London | IPsec | 78 ms | 0.0 % | 2 ms | Online |
| São Paulo | LTE backup | 96 ms | 0.2 % | 9 ms | Failover |
Change CHG-1187 · acc-sw-04 SSH · candidate config
Workflow 4-eyes approval
- Requested by J. Tremblay
- Approved by A. Okafor
- Fingerprint verified, credentials sent in memory
- Applied by Corvane probe in 38 s
- Post-change check: port in VLAN 999
| Device | Vendor family | Method | Last backup | Versions | Baseline |
|---|---|---|---|---|---|
| fw-edge-01 | Next-gen firewall | REST API | 02:00 | 184 | 2 rules differ |
| core-sw-01 | Campus switch | NETCONF | 02:00 | 96 | Compliant |
| wlc-01 | Wi-Fi controller | SSH | 02:01 | 71 | Compliant |
| sdwan-fra-01 | SD-WAN edge | REST API | 02:01 | 53 | NTP differs |
FND-2291 · Internal SMB scan from 10.20.4.17High · Open
- First seen
- 03:12:08 · Montréal HQ
- Behaviour
- TCP 445 to 212 hosts in 3 min
- Baseline
- host never used SMB before
- Source port
- acc-sw-04 · Gi1/0/17 · VLAN 40
- Evidence
- mirror port + IPFIX + syslog
- Asset
- unmanaged Windows host
Response executed by the probe, logged in the audit trail
Choose an action to see how containment runs.
Correlated signals last 15 min
- HighPort scan pattern on TCP 445 from 10.20.4.17
- MediumNew MAC address on Gi1/0/17, no 802.1X session
- InfoDHCP lease issued to unknown hostname DESKTOP-7Q2
Corvane Console preview. Illustrative data.
Capabilities
Everything a network team reaches for, in one appliance.
Vendor-neutral by design. Corvane talks to your equipment through open standards and documented APIs, so it fits the network you have today and the one you buy next.
The network multi-tool
One appliance in place of a toolbox.
Each blade replaces a tool your team would otherwise buy, install, patch and connect to the others. Point at a blade to see what it does.
Architecture models
Five ways to deploy. One security model.
Whatever the shape of the site, the rule stays the same: the probe works inside your network and only ever calls out to the console. Pick the model that fits each site, and mix them freely.
Deployment
From factory to console in five steps.
Nobody needs to travel to the site. The appliance arrives prepared, someone plugs it in, and your team takes it from there in the console.
Prepared
Ubuntu Server LTS and the Corvane agent installed at the factory, Corvane branding on the case and boot screen.
Shipped
Drop-shipped straight to the client site, in Corvane packaging, anywhere in the world.
Plugged in
Power and one LAN cable. Preset static IP or DHCP. No keyboard, no screen.
Enrolled
Single-use token valid 24 hours. The probe creates its own key and joins over HTTPS 443 with mTLS.
Watching
Devices, tests, logs and flows added from the console. The probe applies its new configuration within a minute.
Appliances
A model for every site. Or none at all.
From the small store to the 10G campus, plus a rugged unit for the field. Already run a hypervisor? Corvane Virtual delivers the same software as a virtual machine.
Appliance images are illustrations. Hardware may change between production batches with equal or better specifications.
Security and trust
Built so your security team says yes.
A device that sees your whole network has to earn its place on it. Here is exactly what Corvane does on your network, how it reaches the console and who can touch it. No surprises at the firewall review.
One connection, outbound only
SNMP 161 · ICMP · API 443 · SSH 22 · NETCONF 830HTTPS 443 outbound · mTLSThe complete list of flows to allow
| Flow | Ports | |
|---|---|---|
| Probe → Corvane Console | TCP 443 | Required |
| Probe → install and updates | TCP 80/443 to OS and package repositories | Required |
| Probe → your devices | UDP 161 · ICMP · TCP 22/443/830/4343 | Per device |
| Devices → probe: logs and flows | 514 syslog · UDP 2055/4739/6343 NetFlow, IPFIX, sFlow | Optional |
| Probe → Internet: experience tests | ICMP · UDP 53 · TCP 443 · UDP 3478/19302 | Optional |
| Probe ↔ probe at another site | UDP 5005 call quality between sites | Optional |
Nothing on this list is inbound from the Internet. Mirror-port capture, when used, arrives on a dedicated receive-only interface.
A unique identity per probe
- Unique client certificate; the key is created on the probe and never leaves it.
- Valid 90 days, renewed automatically.
- Revocation takes effect in under a minute.
Access with MFA and roles
- Single sign-on through Microsoft Entra ID, MFA required.
- Three roles: Read, Write, Administrator.
- 12-hour sessions; lockout after 5 failed attempts.
Everything is audited
- Every change, sign-in and download.
- Who, when, from where and what; passwords masked.
- Kept 2 years, exportable to CSV.
Your credentials, protected
- Device credentials encrypted in the console.
- Sent to the probe in memory, one task at a time.
- Device fingerprint checked before anything is sent.
Signed updates
- Every release signed with Ed25519 and verified on the probe.
- No rollback to an older release.
- A failed update reverts to the previous one.
Clear data handling
- Hosted on Microsoft Azure, Canada Central; daily backups kept in region.
- Data isolated per customer; TLS 1.2 and 1.3.
- Metrics kept 13 months, logs 90 days.
Partners worldwide
Built to be resold, managed and shipped anywhere.
Integrators, managed service providers and resellers run Corvane for their own clients. One multi-tenant console, appliances drop-shipped to any site, and a security story your clients' auditors can read in ten minutes.
Questions
What network and security teams ask first.
Do we need to open any inbound ports or set up a VPN?
No. The probe opens one outbound HTTPS connection on port 443 to the console, authenticated in both directions with mTLS. Nothing on the Internet can initiate a connection to it.
Does the probe sit inline? Can it break our traffic?
Never inline. Corvane polls and tests from the side and, for traffic analysis, receives a copy of traffic from a mirror port or TAP on a receive-only interface. If the probe is unplugged, your network carries on exactly as before.
Which vendors does Corvane support?
Corvane is vendor-neutral. It reads devices through SNMP v2c and v3, ICMP, SSH, NETCONF and REST APIs, and receives syslog, NetFlow, IPFIX and sFlow. If a device speaks one of these, Corvane can see it.
Physical or virtual: which should we choose?
Choose physical for branches, plants and sites without a hypervisor. Choose Corvane Virtual for data centres and sites that already run VMware, Hyper-V, Proxmox or VirtualBox; it needs 2 vCPU, 4 GB of RAM and 40 GB of disk to start. Both run the same software and appear the same way in the console.
Who can change our device configurations?
Only users with the Write or Administrator role, signed in with MFA. Credentials stay encrypted in the console and reach the probe in memory for one task at a time, after the device fingerprint is checked. Every change is recorded in the audit log.
Where is our data stored, and for how long?
The console runs on Microsoft Azure in the Canada Central region, with daily backups kept in the same region and each customer's data isolated. Metrics are kept 13 months, logs 90 days and the audit log 2 years.
Can a partner manage several clients?
Yes. The console is multi-tenant: each client has an isolated tenant, and partner staff move between the tenants they are allowed to see, with roles applied per tenant.
Get started
Plug in.
See everything.
Tell us about your network. We will size the right appliance or virtual probe and ship a trial unit to the site of your choice.
- A Corvane architect reviews your sites and flows with you
- The security sheet for your firewall team, before anything ships
- A trial probe connected to your console in under an hour once plugged in
Prefer email? Write to sales@corvane.io