SOC
Where every Core module lands
- Live, partial, and roadmap labeled honestly on the platform page.
- Detection, risk, compliance, and identity share the same incident.
- Click a module, then come back to the operator board.
Core module · IT→OT correlation
When corporate compromise reaches the plant floor and one incident, not two tickets.
Endpoint stacks see identity abuse. Edge sees protocol writes. CyberDragon stitches both into an explicitly labeled Enterprise→OT pivot so SOC analysts and plant engineers read the same story and across W15, W60, and W24 windows.
What it delivers
Live in Core today.
Explicit pivot labeling on correlated incidents
Identity-to-protocol timeline stitching
Engineering workstation and industrial DMZ crossover detection
MITRE ATT&CK + ICS tactic coverage on one object
OPA-guarded response proposals with evidence sealing
Lab-validated S2 IT/OT pivot scenario
How it works
From signal to sealed evidence.
01
Enterprise signal
Failed auth bursts or successful logins land in the W15 burst window.
02
Intel match
Source addresses match C2 or staging indicators in the fused corpus.
03
Lateral movement
Remote sessions to engineering hosts join through the W60 window.
04
OT anomaly
Edge reports unexpected Modbus writes or DNP3 commands from that host.
05
Pivot declared
Incident is labeled Enterprise→OT and not two unrelated alerts.
06
Guarded response
Playbook proposes containment; OPA evaluates OT action class independently.
Playbooks
SOAR module in the workspace
- Run from the incident, not from a disconnected automation island.
- OT guardrails stay in the path.
- YAML for teams who version playbooks.
Key capabilities
Built for regulated IT/OT estates.
Signal sources
What feeds this module.
Identity & MFA
Session issuance, MFA outcomes, and API-key usage per tenant.
Enterprise syslog
Corporate AD, VPN, and EDR-forwarded events via syslog or HEC.
Edge parsers
Modbus function codes, DNP3 controls, OPC-UA session changes.
Threat intel
C2 and staging indicators raise confidence during pivot assembly.
UEBA
User and entity behavior
- Anomaly signals join the same kill chain as OT protocol events.
- Useful when identity abuse starts the campaign in enterprise.
- Not a stand-alone UEBA SKU.
Proof points
Measured in the lab and not marketing adjectives.
S2
IT/OT pivot scenario detected
14.3s
APT kill-chain MTTD (lab)
6/6
Attack scenarios detected
W15·W60·W24
Cascading windows
Lab-validated metrics. Proof of Value results may vary.
Explore platform
Related capabilities.
Full platform menu
Every plane and module in one stack.
Platform overview
One platform, two planes and Core control plane and Edge collector for converged IT/OT.
Core control plane
Kafka-backed indigenous SIEM/SOAR and ingest, detection, risk, compliance, and response.
Edge collector
Passive SPAN capture at the industrial DMZ and telemetry up only, no PLC agents.
OT-native capture
Modbus, DNP3, OPC-UA, and MQTT parsed natively at Purdue L3.
SIEM + SOAR
Indigenous global SIEM and Temporal-orchestrated SOAR with human approval gates.
Kill-chain detection
W15 / W60 / W24 cascading windows across MITRE ATT&CK and ICS tactics.
FAQ
Frequently asked questions.
Watch a pivot assemble on sample Enterprise/OT telemetry.
A dedicated CyberDragon tenant on your own traffic and not a slide deck. See kill-chain cyber defense on your network.