Know every connected thing on your network — and keep each kind where it belongs

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

ThingGuard turns what NetWatch and NetworkGate already see into one inventory of every device, classifies each one with its reasons, scores its risk and, through NetworkGate, puts each class of device in its own VLAN or quarantine.

2The challenge

Most of what is on a network today cannot run an agent: cameras, printers, IP phones, smart TVs, building controllers, medical modalities, sensors. Nobody has a list of them, half answer on telnet or a default web page, some are reachable from the internet through a forgotten port forward, and they sit on the same VLAN as finance — so one compromised camera is a way in for everyone.

The TotalHeal approach. ThingGuard builds one inventory from what TotalHeal already sees on the wire and at the switch port — NetWatch sensors, NetworkGate sessions and UEM — and classifies every device from its manufacturer, host name, software banners and the protocols it answers on, showing the reasons. On the Professional tier it scores each device’s risk, raises alerts when a device starts behaving differently and puts each class of device in its own VLAN or quarantine through NetworkGate.

3Architecture

4How it works

1. SeeNetWatch sensors and NetworkGate report every device on the wire and at the switch port.
2. ClassifyEach device is classified from its vendor, name, software and protocols, with the reasons shown.
3. ScoreInternet-reachable admin services, telnet, clear-text logins and heavy traffic raise its risk.
4. SegmentEach class goes to its VLAN or quarantine through NetworkGate.
5. WatchUnusual behaviour raises an alert; on Elite a device named by a high alert is quarantined.

5Capabilities in detail

• One inventory, no agentsEvery device NetWatch sensors and NetworkGate see — address, MAC, host name, ports, software, the switch port or SSID it joined through — merged by MAC, with UEM-managed computers marked as managed.
• Classified, with the reasonsCamera, printer, VoIP phone, TV and media, building automation, medical, industrial, network equipment, storage, IoT sensor, payment terminal, computer or phone — from the MAC vendor, DHCP host name, software banners and protocols such as RTSP, IPP, SIP, BACnet, DICOM, HL7, Modbus and MQTT. Each class shows the signals behind it and a confidence; a device with no clues stays “not identified”.
• You can correct itSet a device’s class by hand when you know better; the next sweeps keep your choice, and the change is audited.
• Risk per deviceAdmin services reachable from the internet, telnet and FTP, clear-text logins, web admin over plain HTTP only, heavy internet traffic and devices not registered with NetworkGate add to a 0–10 score, each factor listed.
• Behaviour alertsA device that starts reaching dozens of new internet addresses, or whose admin service becomes reachable from the internet, raises an alert in the same incident queue as everything else (MITRE ATT&CK T1041).
• Segmentation by classChoose per class: leave as is, put in a VLAN, or quarantine. ThingGuard registers each device with NetworkGate in its class’s VLAN or quarantines it, and switches that support change of authorisation move it at once.
• Quarantine on incidentsOn the Elite tier, a device named by an open high or critical alert is quarantined automatically for the classes you choose.

6Security and data handling

• Reasons, not guessesEvery class shows the signals behind it; a device without clues stays not identified.
• Your corrections stayA class set by hand is kept by every later sweep.
• Managed computers are left aloneDevices TotalHeal UEM manages are never moved by a class policy.
• Every change is auditedClass changes, VLAN moves and quarantines are recorded with who or what made them.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• A TotalHeal NetWatch sensor on a SPAN or TAP port, or NetworkGate on your switches
• NetworkGate for VLANs and quarantine by class

Start a 30 days, up to 100 devices trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.