Products for IT and OT

How does sensor discover devices?

sensor observes mirrored network traffic or collects data directly on Windows and Linux devices. Approved queries in networks, directories, and cloud servicesCloud refers to on-demand IT resources such as compute, storage, platforms, or software that are consumed over a network. can add information.

Active queries require an explicitly approved scope. The appropriate collection method depends on your environment.

What do existing IDS systems contribute?

sensor can ingest Suricata notifications. They add attack-detection findings to device and connection data. The available findings depend on the configured collection.

How is collected data passed on?

An individual sensor keeps its data locally. The optional Fleet Manager combines data from multiple sensors. sensor initiates the connection to a Fleet parent that has accepted its enrollment; collected data stays on site during a connection outage.

Passing sensor data to inventory requires a configured integration. The diagram shows product roles; the actual handoff depends on your integration.

How do notifications reach your team?

A configured webhook/API connection can pass events to focusAlert. This integration is optional. In focusAlert, rules determine who is notified and how a notification is forwarded.

Depending on the configuration, notifications reach the responsible people by email, phone or browser push.

Who can access the applications?

platform manages sign-in and separate customer environments for inventory and focusAlert. Users sign in through the configured identity providerAn IdP creates and manages identity information and provides authentication services for applications., such as Microsoft Entra IDMicrosoft Learn overview of Microsoft Entra and Microsoft Entra ID as a cloud-based identity and access management service.. Roles assign permissions to usersNIST project page on role-based access control (RBAC).. You can define who may use each application.

The internal secnostic® Identity issues tokens for connected applications as an OpenID ConnectOIDC (OpenID Connect) is a standard that lets users sign in through an external identity provider instead of keeping a separate password for each application. issuer. User sign-in stays with the configured identity providerAn IdP creates and manages identity information and provides authentication services for applications..

What are certificates used for?

sensor can collect certificate information from approved TLS queries and suitable network data, such as the issuer and fingerprint. The available information depends on the collection method.

Certificates serve a different purpose for the connection between sensor and Fleet: With mTLS, both ends of the connection authenticate themselvesIETF specification of TLS 1.3 with server and optional client authentication. General protocol reference, not a statement about a product's TLS version.. Fleet issues a client certificate to the enrolled sensor for this purpose. This transport authentication is not product certification.