The boxes are Intrusion Prevention Systems (IPSs) that work by monitoring for "Indicators of Compromise" (IoC). This would be network traffic that is unexpected in your environment; network traffic that goes to a known bad destination; or network traffic that contains packets consistent with malware.
Typically, these boxes come with a subscription. The company selling them sends out frequent updates (daily or more often) that refresh the IoC database. If they discover that some ransomware reaches out to https://ransom.keyserver.evil.example.com, they might immediately add the network address to the IPS blacklist, and publish it to their customers as soon as they can. If you have a device on your network that tries to connect to get a ransomware key, their IPS will break the connection so you don't get infected.
Some of these boxes also come with software that maintains an inventory of your devices. You can take a look at all of the little IoT things on your network today, and bless them all. Tomorrow, if it detects there's a new node on your network, it can pop up a warning on your mobile phone that says "New thing detected on your network, authorize (yes/no)?" This might help you block someone borrowing your wifi, or hacking into your network.
There isn't a direct open source replacement for all of these functions; not because the technology is so special, but because the constant updating of the IoC database requires intel constantly gathered by humans responding to new incidents, and paying a bunch of humans is expensive. You can achieve some of this functionality with an open source IPS system like Snort, but the Snort "community" subscription is updated 30 days after their commercial subscription. That's quite slow when today's common threats include 0-day based malware.
