Description
This is the annual Splicecloud hardware probe subscription. You will require a hardware probe (purchased seperately).
The Splicecloud hardware probe performs detailed analysis of OT network traffic, dissecting common ICS protocols, and detecting known exploits. The outcome from this analysis is forwarded through to Splicecloud for further evaluation. The Splicecloud analytics engine applies machine learning models to the observed flows, leveraging the near-deterministic nature of OT network communication patterns to keep watch over the OT network, highlighting only anomalies and outliers.
A hardware probe provides visibility into the OT network by consuming port mirror / span port traffic. Hardware specifications are shown under the hardware probe product.
Data received by correctly configured hardware probes and supported by a hardware probe subscription will be visible in the Splicecloud dashboard within 5 minutes. The standard Splicecloud tenant can process up to 30k flow records per hardware probe per hour.
Features
- Allows for visibility where there is no Virtualisation infrastructure
- Visibility where underlay infrastructure does not support Netflow/Sflow
- Node and services detection
- Automatic probe triage
- Behavioural analysis
- Outlier detection
- Metadata transfer is encrypted through to Splicecloud
- One-way channel, no back channel to the OT network
- Automatic node identification (dependant on ICS protocols in use) as well as through companion agent
Requirements
- Probe IT facing port must be able to reach Splicecloud
- Customer to commission the hardware probe once on-site, including the configuration of port mirror / span port and required firewall rules
Splicecloud standard Terms and Conditions are available here.
