Your hypervisors,
finally visible.
An agentless infrastructure plugin: it polls the native API of VMware, Proxmox, Hyper-V, XenServer and Nutanix from a read-only account, and brings hosts, virtual machines, datastores and detections into UniSOC.
Your hypervisors run all your virtual machines, yet the hypervisor layer is most often the only IT tier that goes unmonitored. You don't install an agent on them: they are locked-down appliances. The plugin does the opposite — it queries their native API from a read-only account and feeds back inventory, capacity and attacks targeting them, over the EDR channel already in place.
From threat to evidence, in real time.
The module captures the signal, SYLink AI correlates it and decides — you keep control.
The technology, in detail.
What the module actually does — functions, not promises.
Five hypervisors, a single plugin
- VMware vSphere / ESXi
- Proxmox VE
- Microsoft Hyper-V
- Citrix XenServer / XCP-ng
- Nutanix AHV — Prism Element, REST API v2.0
Inventory & capacity
- Hosts, virtual machines, datastores
- Storage saturation: alert and critical thresholds
- Memory and CPU per host
- Unreachable host or out of normal state
- Backups uploaded with inventory
Collection that weakens nothing
- Read-only account, no write access
- Credentials never hardcoded
- TLS with pinned certificate fingerprint
- Reporting via the existing mTLS EDR channel
- A dedicated package per hypervisor
Detection of infrastructure attacks
- Ransomware targeting hypervisors (ESXiArgs-type)
- Host out of normal state or unreachable
- Blast radius: the VMs that go down with the host
- Correlation with EDR and DPI probe
What is it actually for?
Spot an ESXiArgs coming
Encrypting a hypervisor's datastores takes down the whole SI overnight. The anomaly surfaces to SYLink AI before the VMs go down.
Avoid downtime from full datastore
A datastore at 95 % freezes every VM it hosts. The threshold is monitored continuously and alerts before saturation, not after.
Take infrastructure out of the blind spot
A workstation and a hypervisor do not carry the same risk: servers and virtualisation hosts are treated separately, with the actual inventory.
Driven by SYLink AI, hosted 100% in France (HDS v2), with no Cloud Act exposure. Every decision is logged and defensible under NIS2 and DORA.
One building block of the SOC — never on its own.
Each module feeds the others through SYLink AI.
Ready to see what is really
happening on your network?
First trial free, no credit card, no commitment. On your existing infrastructure.