The list below is generated from the real configuration of the OT sensor, not from assumptions.
| Live parsers on the sensor | Modbus (502), DNP3 (20000), EtherNet/IP (44818) |
|---|---|
| Offline capture analysis (Zeek + ICSNPP) | S7comm, PROFINET, BACnet, ENIP/CIP, Modbus, DNP3 |
| ICS/SCADA detection rules | 411 rules: Modbus/DNP3/S7/IEC-104/CIP (proprii) 25, ET SCADA 119, ENIP/CIP 81, Rockwell 73, S7/Siemens 47, OPC 31, IEC-104 11, DNP3 7, Modbus 6, Omron 7, Mitsubishi 2, Schneider 2 |
| Passive layer-2 discovery | ARP, LLDP, CDP, PROFINET-DCP, STP, DHCP, mDNS, NetBIOS, SSDP |
| ICS protocols recognised in the inventory (ports) | Modbus, S7, IEC-104, DNP3, EtherNet/IP, BACnet, Fox/Niagara, Red Lion, OMRON FINS, MELSEC, GE-SRTP, PCWorx, ProConOS, OPC-UA, PROFINET |
| IT protocols seen in the process network | TLS (JA3/JA4, certificates), HTTP, SSH (HASSH), DHCP, SMB, SNMP, FTP, RDP, Kerberos, DCE/RPC, IKE, MQTT, NFS, TFTP, NTP, QUIC, mDNS, Telnet, VNC, SMTP |
Total rules loaded on the sensor: 53,340, 0 failed at the last check (2026-11-05). PROFINET and BACnet: no alert rules in the public rule sets; they are covered by passive discovery (PROFINET-DCP), by the inventory (BACnet/UDP 47808) and by offline analysis.