Industrial Defender builds in a wide variety of hardware, firmware and software data collection methods, including active, agentless and passive options, into one sensor. Our solution provides features that a passive solution can’t, including:
Device Configuration Data
- Installed firmware and software inventory, including versions
- OS, including vulnerabilities and patches installed
- File integrity monitoring
- Open ports and services
- Policies modified
- Removable media installed
- Malicious code detected/AV
- Failure of event logging
- Serial number
*This list is not all encompassing. The data collected varies for each device, dependent upon the manufacturer, model, and version.
System Access & Authentication
- Successful and failed login attempts
- Generic and shared user accounts
- Local and A/D accounts
- Password parameters and age
- User account locked
- Policies modified
- Privilege raised
- Failure of event logging
*This list is not all encompassing. The data collected varies for each device, dependent upon the manufacturer, model, and version.
Firewall Information & Events
- Firewall rules, including change detection
- Blocked execution (packet)
- Blocked unauthorized file
- Policies modified
*This list is not all encompassing. The data collected varies for each device, dependent upon the manufacturer, model, and version.
Asset Resource Utilization & Status
- CPU usage over time
- RAM usage over time
- Disk space
- Swap space
- Connectivity lost
- Shutdown
- Rebooted and boot checksum
- Backup failure
*This list is not all encompassing. The data collected varies for each device, dependent upon the manufacturer, model, and version.
We can also ingest data from your passive monitoring solution to give you more granular asset data and better SIEM integrations.
