DENIS

Solution · Industrial and manufacturing

Industrial network security for mixed IT and OT sites

Plants and production sites run office IT, building systems and controllers on networks that were rarely designed together. DENIS gives plant IT, OT engineers and security staff one passive view of the devices and the industrial conversations, without sending anything to a controller.

Passive OT monitoringRead the OT guide

Why mixed IT and OT networks are hard to watch

Production cells, engineering workstations, remote-maintenance routers, cameras and office PCs often share switches and sometimes subnets. Controllers and HMIs cannot run security agents, many were installed long before anyone asked who talks to them, and some react badly to scans. The result is a network where nobody can say with confidence which devices exist, who programs the controllers and whether anything new appeared.

Asset visibility across IT and OT

DENIS builds one inventory for IT and industrial devices from what it observes on the network. Each device shows its manufacturer, the evidence behind its type, the industrial protocols it speaks and whether it acts as a server or a client. You add what only people know: owner, location, criticality, Purdue level and zone or cell.

  • Industrial devices are identified from their protocol traffic and from announcements such as LLDP, CDP, PROFINET DCP, EtherNet/IP ListIdentity and BACnet I-Am.
  • A review queue lists every new device until someone has looked at it.
  • Advisories from ICS-CERT are matched to devices by vendor, as context.

Passive monitoring, by design

DENIS reads a copy of the traffic from a mirror (SPAN) port or a network tap. In its OT profile it sends no ARP sweep, ping or port scan at all, and in every profile a device identified as industrial is never pinged or scanned. DENIS is never in the traffic path, so if it stops, the plant does not notice.

  1. Your networkPCs · servers · cameras · PLCs · HMIs
  2. SPAN / mirror port or TAPread-only copy
  3. one way
  4. DENISdecodes, does not transmit on the mirror
A mirror port or tap gives DENIS a copy of the traffic. DENIS listens on it and sends nothing back into it.

Industrial protocols it decodes

Modbus/TCP, Siemens S7comm and S7comm-plus, EtherNet/IP with CIP, DNP3, BACnet/IP, OPC UA, IEC 60870-5-104, IEC 61850 (MMS and ICCP, GOOSE, Sampled Values), PROFINET IO, Omron FINS, MQTT and CoAP; HART-IP, KNXnet/IP and CODESYS are recognised. Decoding is listen-only and deliberately shallow: DENIS sees which protocol, which side is the server, and whether a message is a read, a write or a control command.

NDR-style detection: what it alerts on

  • Control commands it can see on the wire, such as a PLC stop or start, a program download, a restart or an operate command. S7comm-plus stop and download are not reported as control commands.
  • A new client, server and protocol path that did not exist during the learning period, scored higher when it writes or sends commands.
  • Industrial protocol traffic to or from an address outside the local network.
  • A GOOSE control block published from two different sources.
  • Your own OT rules, such as an allow-list of the only devices permitted to talk to a controller, or “tell me when this command reaches that device”.
  • Zones and policies: which parts of the network may talk to which, and an alert when a flow crosses a boundary without permission.
  • New in 4.3: new control functions, program uploads, several masters writing to one controller, a changed device identity, scanning, new industrial protocols, remote-access paths and commands outside working hours.

An investigation workflow

Each alert carries a 0–100 score built from named reasons, what happens if it is ignored and when it is safe to ignore. Related alerts are grouped into one incident with a timeline and the devices involved. The OT view shows a communications matrix of reads, writes and control commands per path, and alerts can be sent to e-mail, chat tools or your SIEM.

Deployment

One collector per segment or cell, on a small Linux machine connected to a mirror port of the switch that carries the cell or area traffic. Several sites report to one console through collectors that connect outbound only. Nothing is installed on PLCs, HMIs or engineering stations.

$ denis run --profile ot --iface eth1

NAC-style response, kept away from the process

DENIS can contain an IT device through supported switches and firewalls when an administrator decides to, after a preview. Automatic actions never touch industrial devices, the gateway or DENIS itself, and a hands-off list names devices DENIS never acts on.

Industrial devices with Purdue level, zone, type and protocols, above a communications matrix counting reads, writes and control commands per path
The OT view on the built-in demo network: industrial devices and who reads from, writes to or controls them.

Illustrative situations

Illustrative situations, not customer cases. Each names the detection in DENIS that reports it and what that detection needs.

  • Illustrative situation, not a customer case

    An unknown service laptop in the production network talks to a PLC

    A supplier plugs a laptop into a switch in the production cell and connects to a controller over an industrial protocol.

    What DENIS reports. The device joins: “new device”, scored higher because it joined a subnet that is mostly industrial devices. When it talks to the controller: “new industrial conversation”, a client, server and protocol path that did not exist during the learning period, scored higher when it writes or sends control commands, when the target is a controller, and when the client itself appeared within the last hour.

    Needs. A mirror port or tap that carries the cell’s traffic; after the learning period (24 hours by default).

  • Illustrative situation, not a customer case

    A PLC is sent a function it never received on that path, or its program is copied out

    An engineering workstation that has read from a PLC for weeks suddenly uses another function on it, or someone copies the program out of a Siemens S7 controller that speaks S7comm.

    What DENIS reports. “New industrial function” (new in 4.3): a function a learned client-to-controller path never used before, scored higher when the same window carried writes or commands. “Program upload” (new in 4.3): a program copied out of a controller over S7comm or IEC 61850 MMS, scored highest the first time a client does it; never kept quiet. A program download, stop or start is a separate “control command” alert.

    Needs. A mirror port or tap; the path must have been seen through its learning period. Program uploads are recognised for S7comm and MMS only (not S7comm-plus, used by S7-1200/1500 with TIA Portal), and encrypted protocols are not judged.

  • Illustrative situation, not a customer case

    A remote-access tool reaches a device in a control cell

    RDP, VNC, TeamViewer, AnyDesk or RustDesk reaches a machine inside a production cell, from the office network or from the internet.

    What DENIS reports. “Remote-access path into a control cell” (new in 4.3): such a session from a device at Purdue level 4 or above to one at level 2 or below, or a completed connection from the internet to a device at level 2 or below or to an industrial device without a level. On the office side, “remote-access tool” reports the first use of such a tool by a device.

    Needs. Purdue levels set in the register for the devices, and east-west recording or traffic accounting on the internet link. An approved support path is handled with a rule exception.

Limitations

  • DENIS has not yet been run against live traffic at a real industrial site. The decoders are checked against real captures of each protocol. Plan a representative trial period, including maintenance windows.
  • It sees only the traffic that reaches the ports it listens on. Where you mirror decides what you see: GOOSE stays on the station bus, PROFINET real-time traffic stays in the cell.
  • Decoding is shallow: it knows that a write happened, not which value was written. A missing alert is not proof that no command was sent.
  • Encrypted industrial traffic shows who talks to whom and how much, not the content. HSR-tagged frames are not unwrapped.
  • DENIS is not a replacement for a dedicated OT security platform, a safety system or an industrial firewall.
  • An organisation may evaluate the Community edition free for 30 days from its first installation, on up to 100 devices, for evaluation and demonstration only; running its operations on DENIS needs a commercial license from the author, in the tiers DENIS 500, DENIS 5000 and DENIS 20000 (above 20,000 devices individually). See information for organisations.