Detection engineering
Generate traffic while developing a rule, changing an analytic, or checking a detection after an update. Ground truth records the expected activity so you can compare what fired with what the dataset represents.
Use cases
Use NetMetria when you need network traffic for work you already do: developing detections, checking product changes, preparing exercises, or running controlled comparisons.
NetMetria supports teams that need inspectable network traffic without rebuilding a complete adversary environment for each dataset.
IDS, IPS, NDR, SIEM, and analytics
Generate fresh scenario-driven traffic when an existing capture does not fit the test. Exercise sensors, parsers, detections, correlation logic, and security analytics with traffic built for the question at hand.
Regression testing
Re-run a defined scenario after parser, rule, engine, or product changes and compare the resulting detection behavior against the earlier test.
Packet-analysis and detection exercises
Prepare scenario-based PCAPs and ground truth for analyst or student exercises without constructing and resetting a complete lab for every exercise.
Defined cybersecurity datasets
Generate defined datasets and controlled scenario variations when research or analysis requires traffic that existing public captures do not provide.
Before-and-after comparison
Use defined scenario conditions to compare detection approaches, product configurations, or analytics changes without searching for a different capture for each test.
Engineering cost
Dataset creation can require more engineering than the analysis it supports.
A conventional workflow can include virtualization, OS installation, endpoint configuration, network setup, attacker tooling, scenario execution, capture setup, attribution, labeling, ATT&CK mapping, and environment reset.
Compare the full cost of creating the dataset
For recurring test work, the cost is not only the traffic generator. It is the engineering time spent building environments, executing scenarios, capturing traffic, labeling it, and doing the same work again when the test changes.
Evaluate the traffic
Start with the three public PCAPs.
Download them without registration and inspect the traffic. If the captures match the kind of evidence you work with, Explorer is intended to let you generate this type of dataset for your own scenarios.