Advanced security appliance and cloud analytics for medium enterprises that detects threats missed by firewalls and antivirus using behavioral analytics and machine learning. A small passive perimeter appliance extracts session metadata and sends it to a cloud platform for extended storage and timeline-based detection of external and insider threats.