TotalHealDatasheet · 27 October 2026
TotalHealIndustrialGuard
OT & Industrial Security
A passive OT sensor: industrial protocols, an asset inventory learned from them, and detections for PLC stop, program download and firmware changes.
- Cloud (SaaS)
- On-premises
- Air-gapped
The challenge
Control networks run PLCs, HMIs and engineering stations that cannot take an agent and must never be scanned. Plant teams often do not know every controller on the network, and nobody would notice a program download at 2 a.m.
The answer
IndustrialGuard listens on a SPAN or TAP port and never sends a packet to the plant network. It parses industrial protocols, builds the asset inventory from what the devices say, and raises ICS-specific detections next to your IT alerts.
- Status
- Available
- Deploys as
- Cloud (SaaS) · On-premises · Air-gapped
- Runs on
- Sensor; Protocols
- Priced per
- Sensor per year
- Trial
- 30 days
- Licence
- Sold on its own; one TotalHeal console
Supported platforms
- Ubuntu20.04, 22.04, 24.04
- Debian11, 12
- Red Hat Enterprise Linux8, 9
- Modbus · DNP3 · S7
- EtherNet/IP · CIP · BACnet
How it works
- MirrorConnect the sensor to a SPAN or TAP port.
- ParseIndustrial protocols decoded from the mirrored traffic.
- InventoryControllers, HMIs and stations learned from what they say.
- DetectProgram downloads, stops, firmware changes, new writers.
Reference architecture
Key capabilities
- Strictly passiveThe sensor listens on a SPAN or TAP port and never transmits on the control network.
- Industrial protocolsModbus, DNP3, Siemens S7, EtherNet/IP and CIP, and BACnet parsed, using the open CISA ICS protocol parsers.
- Asset inventoryControllers, engineering stations and HMIs, with vendor, model and firmware where the protocol reports them.
- ICS detectionsProgram download and upload, controller stop and start, firmware change, new writers to a controller, discovery sweeps, reporting disabled and internet exposure — mapped to MITRE ATT&CK for ICS.
- One place for IT and OTOT alerts arrive in the same console and incidents as endpoint, network and identity alerts.
- Air-gapped installThe sensor installs online or from an offline kit on Ubuntu, Debian and RHEL-family Linux.
Deployment options
Cloud (SaaS)AvailableEvents go through the TotalHeal collector.
On-premisesAvailableDelivered with our team from the on-premises kit.
Air-gappedAvailableOffline kit, offline licence file and offline update bundles.
System requirements
Protected platforms
- Ubuntu20.04, 22.04, 24.04
- Debian11, 12
- Red Hat Enterprise Linux8, 9
- Modbus · DNP3 · S7
- EtherNet/IP · CIP · BACnet
On-premises server
- Operating system
- RHEL, Rocky Linux or AlmaLinux 8 / 9; Ubuntu 20.04, 22.04 or 24.04; Debian 11 / 12
- Processor
- 4 vCPU (tested configuration)
- Memory
- 8 GB recommended (6 GB minimum)
- Disk
- 10 GB free for software, releases and backups, plus data
- Sign-in
- Active Directory / LDAP, SAML 2.0 or OpenID Connect
- Software
- Nothing to pre-install: no container runtime, database, web server or Java
Network and access
- A Linux host with a SPAN or TAP port on the control network
- The TotalHeal collector
Alerts and tickets to
- Splunk
- Microsoft Sentinel
- Elastic
- Syslog / CEF
- Jira
- ServiceNow
- Slack
- Microsoft Teams
Technical specifications
| Features | Included | |
|---|---|---|
| Strictly passive | Included | |
| Industrial protocols | Included | |
| Asset inventory | Included | |
| ICS detections | Included | |
| One place for IT and OT | Included | |
| Air-gapped install | Included | |
| Availability by edition | Business | Enterprise |
| Passive sensor, protocols, asset inventory, ICS detections | Included | Included |
| Platforms and coverage | ||
| Sensor | Ubuntu, Debian, RHEL-family Linux with a SPAN or TAP port | |
| Protocols | Modbus, DNP3, S7, EtherNet/IP / CIP, BACnet | |
| Console | TotalHeal web console | |
| Deployment options | ||
| Sensor at your site, SaaS console (India region) | AvailableEvents go through the TotalHeal collector. | |
| On-premises control plane | AvailableDelivered with our team from the on-premises kit. | |
| Air-gapped | AvailableOffline kit, offline licence file and offline update bundles. | |
| Licensing | ||
| Priced per | Sensor per year | |
| Counted | Sensors sending to the organisation | |
| Trial | 30 days | |
| Editions | No Business/Enterprise split is set for IndustrialGuard yet. | |
| Government profile | Government is a profile, not a separate tier or price list: the Elite tier with Government defaults switched on — data residency in India, four-eyes approval of policy changes, a distinct approver for every approval-level action, retention of at least 180 days, and the CERT-In and DPDP reporting clocks. | |
| Procurement dossier | Compliance matrix, bill of materials, architecture and hardening, SLA and OEM authorisation letter, on request | |
| On-premises server | ||
| Operating system | RHEL, Rocky Linux or AlmaLinux 8 / 9; Ubuntu 20.04, 22.04 or 24.04; Debian 11 / 12 | |
| Processor | 4 vCPU (tested configuration) | |
| Memory | 8 GB recommended (6 GB minimum) | |
| Disk | 10 GB free for software, releases and backups, plus data | |
| Sign-in | Active Directory / LDAP, SAML 2.0 or OpenID Connect | |
| Software | Nothing to pre-install: no container runtime, database, web server or Java | |
| Requirements | ||
| Requirement 1 | A Linux host with a SPAN or TAP port on the control network | |
| Requirement 2 | The TotalHeal collector | |