Stop Malware —
before it calls home.
Detect silent, periodic check-ins signalling a compromised device. The threats your antivirus never sees.
Your Antivirus Won't Catch This
Modern malware rarely announces itself. Instead, it installs silently, then reaches out to its operator via short, regular, encrypted messages — beacons. Once a live command channel is confirmed, attackers push further: lateral movement, data exfiltration, ransomware deployment.
Traditional defences inspect files and signatures. Beacons don't look like malware. They look like background traffic — which is exactly the point.
Behavioural Network Monitoring
Beacon Butty sits between your LAN and the internet, tracking and scoring every connection — without any packets being blocked or delayed. Zero impact on your network performance.
Rather than matching against known-bad signatures, it measures behaviour: connection regularity, consistent payload sizes, unusual destination profiles. Two cadence engines run in parallel — RITA's hourly window and a 14-day slow-cadence correlator — so check-ins from minutes to days both get caught. Every finding then passes the alert gate before it ever reaches Slack.
Inside Beacon Butty
Real-time visibility across every layer — from operations and bandwidth dashboards to per-detector deep-dives. Click any screen for a closer look.
A Six-Layer Detection Pipeline
Best-in-class open source components, orchestrated into a single appliance.
Zeek monitors all LAN traffic on the internal interface — passively, with zero impact on throughput. Every TCP / UDP connection is logged with full metadata: timestamps, bytes transferred, connection state, duration, TLS / JA4 handshake details and ARP events.
Hourly, RITA scores every source / destination pair on periodicity, jitter, consistent byte size and duration. A separate cross-DB correlator walks 14 days at a time to surface slow-cadence pairs RITA's sleep-cycle window misses. Strobes and threat-intel hits are flagged independently.
Suricata runs concurrently with ~50,000 community and Emerging Threats signatures against live traffic. STREAM and QUIC infrastructure noise is filtered automatically. Alerts are correlated back to the asset inventory via MAC and IP.
A columnar time-series database on NVMe SSD stores beacon scores, connection records, IDS alerts, JA4 fingerprints and host metrics. Sub-millisecond queries across weeks of data; live logs land on a RAM-backed tier to extend SSD lifespan.
A Flask web application served over HTTPS provides real-time visibility across every detection layer. Eleven purpose-built pages cover beacons, slow-cadence hunting, IDS, assets, false positives, network intel, health, backup and hardware telemetry.
Every finding passes the alert gate — sole-LAN-talker AND non-hyperscaler — before it pages Slack via AWS Lambda. Demoted candidates stay on the dashboards for hunting. A daily 08:00 UTC digest rolls up slow-cadence hunt candidates, top scorers, anomalies and capacity headlines.
What Beacon Butty Catches
Twelve categories of threat, detected continuously — 24 hours a day, 7 days a week.
A Self-Sufficient Appliance
Detection is only half the job. Beacon Butty also gives you the tools to investigate what it finds — and watches itself as carefully as it watches your network.
Gated, Prioritised Alerting
Each alert type can be enabled, disabled or suppression-windowed independently — so you decide what wakes you up.
Every detection passes one final filter before it pages Slack: it must be from a single LAN device talking to a non-hyperscaler destination. Findings reaching CDN or major-cloud ASNs, or destinations that several devices on your LAN already share, are demoted to the dashboards as hunting candidates rather than waking you up. The accountability table on the Health page shows, per detector, how many findings fired and how many were gated — so the filter is auditable, not a black box.
- High-score beacon (perfect 1.0)
- Persistent strobe traffic
- Threat-intel destination match
- Tor exit node contact
- Gateway impersonation / critical L2 anomaly
- JA4 threat-family fingerprint match
- LAN device triggers a P1 Suricata rule
- Repeated Suricata P1 hits (≥5/day)
- Service down (Zeek / ClickHouse / dnsmasq / Suricata)
- WAN unreachable
- Disk > 90% full
- New device on LAN
- Slow-cadence beacon hunt candidates
- Top beacon scorers across the LAN
- Suricata P2 / P3 alert summary
- New devices seen in the last 24 hours
- High-DNS-volume hosts
- TLS / DNS / JA4 / L2 anomaly digest
- Suppressed-by-FP traffic recap
- Health and capacity headline
Built for Small Business and Home Networks
Beacon Butty is designed for networks that matter but don't have a full security operations team behind them — small businesses, professional home offices, and anyone who handles sensitive data and wants to know if something is quietly phoning home.
It is a combined hardware and software solution. The appliance must be physically placed on your network and configured to match your specific environment — this is not software you download and install yourself.
Enterprise-grade threat detection technology, sized and priced for organisations without enterprise budgets.
How it works
- 1 We scope your networkA short discovery call to understand your setup — number of devices, internet connection, and physical access for installation.
- 2 On-site installationA Mustard Research consultant visits to install and configure the appliance. Beacon Butty requires physical placement between your router and LAN — not something that can be done remotely.
- 3 Monitoring beginsFrom the moment it's live, Beacon Butty is watching. Alerts land in your Slack workspace. A daily digest arrives each morning.
- 4 Ongoing supportWe handle ruleset updates, health monitoring, and are on hand if an alert needs expert interpretation. Optional encrypted remote access via Tailscale.
Ready to see what's on your network?
Get in touch to discuss your setup. We'll let you know if Beacon Butty is a good fit and talk through the installation process.