TotalHealThingGuard

How it works

1. SeeNetWatch sensors and NetworkGate report every device on the wire and at the switch port.
2. ClassifyEach device is classified from its vendor, name, software and protocols, with the reasons shown.
3. ScoreInternet-reachable admin services, telnet, clear-text logins and heavy traffic raise its risk.
4. SegmentEach class goes to its VLAN or quarantine through NetworkGate.
5. WatchUnusual behaviour raises an alert; on Elite a device named by a high alert is quarantined.

Reference architecture

Key capabilities

• One inventory, no agentsEvery device NetWatch sensors and NetworkGate see — address, MAC, host name, ports, software, the switch port or SSID it joined through — merged by MAC, with UEM-managed computers marked as managed.
• Classified, with the reasonsCamera, printer, VoIP phone, TV and media, building automation, medical, industrial, network equipment, storage, IoT sensor, payment terminal, computer or phone — from the MAC vendor, DHCP host name, software banners and protocols such as RTSP, IPP, SIP, BACnet, DICOM, HL7, Modbus and MQTT. Each class shows the signals behind it and a confidence; a device with no clues stays “not identified”.
• You can correct itSet a device’s class by hand when you know better; the next sweeps keep your choice, and the change is audited.
• Risk per deviceAdmin services reachable from the internet, telnet and FTP, clear-text logins, web admin over plain HTTP only, heavy internet traffic and devices not registered with NetworkGate add to a 0–10 score, each factor listed.
• Behaviour alertsA device that starts reaching dozens of new internet addresses, or whose admin service becomes reachable from the internet, raises an alert in the same incident queue as everything else (MITRE ATT&CK T1041).
• Segmentation by classChoose per class: leave as is, put in a VLAN, or quarantine. ThingGuard registers each device with NetworkGate in its class’s VLAN or quarantines it, and switches that support change of authorisation move it at once.
• Quarantine on incidentsOn the Elite tier, a device named by an open high or critical alert is quarantined automatically for the classes you choose.

In the console

Deployment options

System requirements

Technical specifications