Industrial Defender ASMFeatures

What can Industrial Defender do? We grouped its capabilities; each group is based on the vendor’s current documentation.

OT asset inventory

A single source of truth for all OT hardware and software details.

  • Four data sources in one interface: physical inspection data, passive monitoring, configuration analysis and active discovery
  • Controllers, RTUs, servers, workstations and network devices
  • More than 200 industrial vendors including Rockwell, Siemens, Schneider Electric, GE and ABB (vendor statement)
Asset overview (Industrial Defender)
Asset overview (Industrial Defender)

Collection methods

Passive for the sensitive segments, active where it is needed: the method matches the environment.

  • Passive monitoring: observes network traffic with zero footprint on the asset; for the most sensitive segments
  • ID Collector: active collection over SSH and native OT protocols
  • OT-native traffic analysis, used selectively where active methods are a poor fit
  • Coverage at the Purdue levels that matter most, without disrupting operations

Configuration and change management

A baseline configuration is kept for every asset, and deviations get noticed.

  • Flag unauthorised changes to ports, users, policies and services across PLCs, RTUs, servers, workstations and network equipment
  • Detect changes from a known-good baseline
  • For NERC CIP-010 R1, detect changes as exceptions; for R2, track baselines on a rolling basis to show 35-day monitoring
SettingBaselineNow
Open ports502, 44818502, 44818, 23
Local usersoperator, engineeroperator, engineer, svc_temp
Firmware2.4.12.4.1
Illustrative example: baseline and current state
Configuration policy view (Industrial Defender)
Configuration policy view (Industrial Defender)

Vulnerability management

Vulnerabilities are not just listed; they are matched to your inventory and prioritised.

  • The OT asset inventory is combined with NIST’s vulnerability database and ICS-CERT alerts
  • Patching and mitigation are prioritised by risk
  • Which asset is affected by which vulnerability is visible on the asset record
Vulnerability list (Industrial Defender)
Vulnerability list (Industrial Defender)

Threat detection and log monitoring

Logs and events are tied to the asset inventory, so you see where something happened and how critical the affected system is.

  • Syslog straight from application servers, firewalls and other critical systems; virtually any text-based log
  • Monitor log files automatically, turn routine entries into events and alert when something needs attention
  • Changes to ports and services, users, software, patches and firewall rules, plus network anomalies
  • The OT Machine Learning Engine adds OT context for detecting and investigating threats such as ransomware

Compliance reporting

Policies mapped to frameworks and audit-ready reports.

  • Capabilities supporting NERC CIP-002, -004, -005, -007 and -010; more than 40 NERC CIP report templates
  • Out-of-the-box policies: NERC CIP, NIS2, TSA Security Directives, AESCSF, NIST CSF, IEC 62443, OTCC and more
  • Audit-ready reports mapped to those frameworks

Integrations

Carry OT data into the security and IT tools you already run.

  • SIEM, SOAR, threat intelligence, CMDB, business intelligence software, IAM, PAM and data diodes
  • The Industrial Defender for Splunk app gives security operators OT data
  • Key event alerts go to the operator console, NOC or SOC
  • Deployed on premises to fit your architecture

How it fits your architecture

Purdue levels

Controllers at level 1 and above, HMI/SCADA and production servers are collected in the same inventory.

On-premises deployment

The platform runs inside your network, with collection components placed passive or active depending on sensitivity.

SOC and IT tools

SIEM, SOAR and CMDB integrations connect OT data to IT security processes.

Frequently asked questions

What is the difference between passive and active collection?

Passive monitoring observes network traffic and leaves no footprint on the asset, which suits the most sensitive segments. Active collection talks to the device over SSH and native OT protocols and returns richer configuration data. Together we decide which method to use where, based on how sensitive each environment is.

Which vendors’ devices does it support?

The vendor states coverage of more than 200 industrial vendors including Rockwell, Siemens, Schneider Electric, GE and ABB. We confirm coverage for your device models and software versions at the start of a project.

Does it replace a firewall or an intrusion detection system?

No. Its focus is asset inventory, configuration and change management, vulnerability management, log and event monitoring and compliance. It works alongside network segmentation and network-based detection as a complement.

How does it relate to IEC 62443?

IEC 62443 expects processes such as inventory, change management and vulnerability management. Industrial Defender helps you run and evidence them, and IEC 62443 is among its out-of-the-box policies. For the standard itself, see our article.

How is it deployed?

The platform is deployed on premises to fit your architecture, with collection components placed passive or active in the network segments. The detailed placement plan comes out of the discovery workshop.

Does it integrate with a SIEM or SOC?

Yes. The vendor’s integrations data sheet lists SIEM, SOAR, threat intelligence, CMDB, business intelligence, IAM, PAM and data diodes, and there is a dedicated app for Splunk.

Let’s take the first step with Industrial Defender together

Tell us where you are and what you want to achieve, and we will outline the right scope and pilot plan. Our team replies within 24 hours.

Request a demo Ask a question