TotalHealIndustrialGuardOT & Industrial Security
A passive OT sensor: industrial protocols, an asset inventory learned from them, and detections for PLC stop, program download and firmware changes.
Trial: 30 days. You sign in to the TotalHeal console with a Sttiz account and activate IndustrialGuard OT Security. No card.
Control networks run PLCs, HMIs and engineering stations that cannot take an agent and must never be scanned. Plant teams often do not know every controller on the network, and nobody would notice a program download at 2 a.m.
IndustrialGuard listens on a SPAN or TAP port and never sends a packet to the plant network. It parses industrial protocols, builds the asset inventory from what the devices say, and raises ICS-specific detections next to your IT alerts.
IndustrialGuard OT Security, feature by feature.
Strictly passive
The sensor listens on a SPAN or TAP port and never transmits on the control network.
Industrial protocols
Modbus, DNP3, Siemens S7, EtherNet/IP and CIP, and BACnet parsed, using the open CISA ICS protocol parsers.
Asset inventory
Controllers, engineering stations and HMIs, with vendor, model and firmware where the protocol reports them.
ICS detections
Program download and upload, controller stop and start, firmware change, new writers to a controller, discovery sweeps, reporting disabled and internet exposure — mapped to MITRE ATT&CK for ICS.
One place for IT and OT
OT alerts arrive in the same console and incidents as endpoint, network and identity alerts.
Air-gapped install
The sensor installs online or from an offline kit on Ubuntu, Debian and RHEL-family Linux.
How IndustrialGuard OT Security works.
IndustrialGuard listens passively on a SPAN or TAP port, parses industrial protocols, builds an asset inventory from what controllers report and detects program downloads, controller stops and firmware changes — mapped to ATT&CK for ICS and raised next to IT alerts.
- MirrorConnect the sensor to a SPAN or TAP port.
- ParseIndustrial protocols decoded from the mirrored traffic.
- InventoryControllers, HMIs and stations learned from what they say.
- DetectProgram downloads, stops, firmware changes, new writers.
Platforms and deployment
Platforms
| Platform | How it is covered |
|---|---|
| Sensor | Ubuntu, Debian, RHEL-family Linux with a SPAN or TAP port |
| Protocols | Modbus, DNP3, S7, EtherNet/IP / CIP, BACnet |
| Console | TotalHeal web console |
Deployment
| Profile | Status |
|---|---|
| Sensor at your site, SaaS console (India region) | AvailableEvents go through the TotalHeal collector. |
| On-premises control plane | AvailableDelivered with our team from the on-premises kit. |
| Air-gapped | AvailableOffline kit, offline licence file and offline update bundles. |
Unit and tiers.
Priced per sensor per year. Counted: sensors sending to the organisation. List prices are not published yet — our team quotes per unit and term.
| Business | Enterprise | |
|---|---|---|
| Passive sensor, protocols, asset inventory, ICS detections | Included | Included |
| Price | Contact sales | Contact sales |
No Business/Enterprise split is set for IndustrialGuard yet.
Government profile. Government is a profile, not a separate tier or price list: the Elite tier with Government defaults switched on — data residency in India, four-eyes approval of policy changes, a distinct approver for every approval-level action, retention of at least 180 days, and the CERT-In and DPDP reporting clocks.
What you need
- A Linux host with a SPAN or TAP port on the control network
- The TotalHeal collector
Procurement documents for IndustrialGuard OT Security
The datasheet is public. The full dossier is sent on request, so we can match it to your tender.
- Datasheet. What the product does, platforms, deployment profiles, tiers and honest limits.
- Compliance matrix. Each requirement marked comply, partial or no, with an evidence reference — CERT-In directions, DPDP, ISO 27001 controls touched, accessibility of the console, data residency.
- Bill of materials. SKUs per sizing, the unit and quantity formula, customer-side components and services.
- Architecture and hardening. How the product is deployed and the hardening guidance for each component.
- SLA. Support tiers, response targets the team can meet, update cadence and end-of-life policy.
- OEM authorisation letter. A MAF template for resellers and system integrators, with product names exactly as on the SKU.
Works well with
TotalHealThreatFusion
Extended Detection & Response (XDR)
One incident across endpoint, network, identity, email and cloud — with or without our EDR.
TotalHealLogIntelligence
SIEM & Log Management
Collect, search and alert on logs from firewalls, DNS servers, servers and identity providers.
Get a quote for IndustrialGuard OT Security.
Tell us how many sensors you need and how you want to deploy. We reply with a quote and the procurement documents you ask for.
Or email business@totalhealsecurity.com.