A common operational picture for the network domain — built passively from Zeek telemetry a hunt team already has. Salient turns observed traffic into a scored dependency graph and a ranked Mission Relevant Terrain-Cyber report: what's out there, what depends on what, and what matters most — with the evidence behind every ranking.
Dropped into an unfamiliar network, a hunt team's biggest cost is time — figuring out what actually matters before an active scan tips off an adversary or trips something fragile. Salient exists to build that picture without touching the grid. It connects read-only to Elasticsearch, aggregates existing Zeek telemetry, and turns observed traffic into a scored dependency graph and a ranked key-terrain report.
The map is a criticality view of observed dependency terrain, not a network diagram — node size and heat emphasize the systems whose compromise or loss would matter most. A declared-device topology layout remains available as an optional cross-check, but it isn't the primary view. The desktop console is a single native window on Linux, macOS, or Windows: connect, scan, browse snapshots, investigate evidence, and export — no active scanning, no change to the deployment being operated on.
Salient ranks key terrain from observed dependency traffic, not labels or icon size. Each rank is a composite of four weighted axes, min-max normalized within the snapshot:
Invalid terrain artifacts — multicast, broadcast, loopback, link-local — are excluded from the composite. Collapsed device nodes inherit their strongest member's rank, and the console's Key Terrain drawer leads with the top-ranked systems and their score-driver evidence.
The same telemetry that ranks key terrain can expose who shouldn't be providing a service at all. Salient infers the services hosts actually provide, flags systems and roles that contradict the asset inventory, and highlights newly appeared hosts, roles, and service dependencies across snapshots.
These are investigation leads backed by observed behavior, not automatic declarations of malicious intent — the operator determines whether a change is expected or hostile.
The console can suggest device tags from communication patterns in a stored snapshot — OpenAI-compatible chat completions, Anthropic Messages, or Gemini GenerateContent endpoints, including local Llama servers and compatible Ask Sage or GenAI.mil routes. Only capped node and edge summaries are sent, never raw Zeek events or Elasticsearch credentials.
Operator-confirmed facts — device names, role corrections, durable labels — ride along as ground truth the model must not contradict. Suggestions land separately from observed evidence: accept tags promotes them to durable labels that survive rescans, dismiss hides them permanently.
Terrain artifacts expose network dependencies and critical systems — protect them at the classification and handling level of the network they describe.
The desktop console is the primary interface, built with Go and Wails. Clone it, install the pinned dependencies, and build:
git clone https://github.com/BushidoCyb3r/salient.git
cd salient
make gui-deps
make guiLinux additionally needs libwebkit2gtk-4.1-dev / webkit2gtk4.1-devel and gtk3. A CLI remains available for automation, drift analysis, and reconciliation without the GUI — see the README for the first-connection walkthrough and read-only Elasticsearch API-key setup.
Salient is free and open source. Point it at telemetry your grid already has and get ranked key terrain, dependency evidence, and hunt leads before you run a single active scan.