The edge cannot be the blind spot.
Heimdall is Zendrix's edge awareness layer. It reads what arrives, recognizes hostile behavior and contains the threat before it reaches operations — leaving a trail of evidence that can be verified.
What Heimdall is
Heimdall is the edge sensor of the Zendrix architecture. It observes traffic reaching the infrastructure, enforces an allowlist policy and turns scattered signals — sensitive paths, 404 bursts, authentication failures — into containment decisions.
It is not a generic firewall or an EDR inside the workload. It is a perimeter sensor with the ability to act: observe, decide and contain at the point where the threat tries to enter.
- Category
- Edge sensing and autonomous containment
- Operates at
- Infrastructure perimeter
- Integrates
- Vidar · Fenrir
- Status
- In development
How it operates
A short loop between signal and response — with humans in command of the decisions that matter.
- OBSERVE01
- DETECT02
- DECIDE03
- CONTAIN04
- PROVE05
- OBSERVEReads edge traffic and host context. What policy does not allow does not become noise: it becomes signal.
- DETECTCross-checks path, frequency, authentication and context. Detection is behavioral, not a loose signature.
- DECIDEEnforces policy: allowlist is law; containment is proportional; every ban has a TTL, a reason and a record.
- CONTAINActs at the entry point — ipset, firewall, block — without touching the workload. Routine action does not wait for a human; strategic action does.
- PROVESeals what happened into a chained evidence record. The record is not a log that can be erased: it is proof that can be verified.
What it protects — and what it does not promise
Heimdall is deliberately narrow. Its strength is doing one thing well: watching the edge and proving what happened.
Protects
- Public perimeter and traffic forwarded through the edge.
- L7 signals: sensitive paths, 404 bursts, authentication failures.
- IP containment with TTL and allowlist policy.
- Evidence chain for investigation and audit.
- Integration with Vidar and Fenrir through internal channels.
Does not promise
- It is not an EDR inside VMs.
- It does not replace workload firewalls or application authentication.
- It does not promise invulnerability.
- It does not execute offensive response.
- It does not turn telemetry into certainty without human decision.
Evidence, not theater
Every containment leaves a trail: the event, the rule, the reason, the time and the owner. Evidence is sealed and chained; the export exists to be verified by third parties, not to decorate a report.
Heimdall was designed to operate where the question is not “was there an alert?”, but “what happened, why, and what was done?”.
Allowlist is law
What policy does not allow does not become a silent exception.
Proportional containment
Every action has a reason, a scope and a time — and can be explained.
Verifiable evidence
The record exists to be checked, not to be taken on faith.
One piece of the Zendrix architecture
Heimdall feeds Vidar with sensor signals and can send passive tasks to Fenrir. The decision remains human; the edge gains time.
It does not replace the other systems. It informs them — and returns evidence so the response can be proportional.
Product status
Heimdall is in development as a Zendrix product. This page is an institutional presentation of the edge layer; there is no public API, console or commercial offer in this version.
This is a marketing page. No operational data is exposed here.