Seeing the plant network without touching it

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

IndustrialGuard listens passively on a SPAN or TAP port, parses industrial protocols, builds an asset inventory from what controllers report and detects program downloads, controller stops and firmware changes — mapped to ATT&CK for ICS and raised next to IT alerts.

2The challenge

Control networks run PLCs, HMIs and engineering stations that cannot take an agent and must never be scanned. Plant teams often do not know every controller on the network, and nobody would notice a program download at 2 a.m.

The TotalHeal approach. IndustrialGuard listens on a SPAN or TAP port and never sends a packet to the plant network. It parses industrial protocols, builds the asset inventory from what the devices say, and raises ICS-specific detections next to your IT alerts.

3Architecture

4How it works

1. MirrorConnect the sensor to a SPAN or TAP port.
2. ParseIndustrial protocols decoded from the mirrored traffic.
3. InventoryControllers, HMIs and stations learned from what they say.
4. DetectProgram downloads, stops, firmware changes, new writers.

5Capabilities in detail

• Strictly passiveThe sensor listens on a SPAN or TAP port and never transmits on the control network.
• Industrial protocolsModbus, DNP3, Siemens S7, EtherNet/IP and CIP, and BACnet parsed, using the open CISA ICS protocol parsers.
• Asset inventoryControllers, engineering stations and HMIs, with vendor, model and firmware where the protocol reports them.
• ICS detectionsProgram download and upload, controller stop and start, firmware change, new writers to a controller, discovery sweeps, reporting disabled and internet exposure — mapped to MITRE ATT&CK for ICS.
• One place for IT and OTOT alerts arrive in the same console and incidents as endpoint, network and identity alerts.
• Air-gapped installThe sensor installs online or from an offline kit on Ubuntu, Debian and RHEL-family Linux.

6Security and data handling

• Never transmitsThe sensor never sends a packet to the plant network.
• No agents on controllersNothing is installed on OT devices.
• Offline installInstalls from an air-gapped kit.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• A Linux host with a SPAN or TAP port on the control network
• The TotalHeal collector

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.