Passive capture
Edge collector at the DMZ
- Receive-only SPAN/TAP. We never inject into the process network.
- Parser health for Modbus, DNP3, and OPC-UA.
- OT-native is a product pillar and not a SIEM adapter.
Pillar 01 · OT-Native
Protocol-native capture without touching the PLC.
A dedicated deep dive for OT-native collection and separate from the Edge hardware story and from Core SIEM/SOAR. SPAN/TAP at L3, Modbus/DNP3/OPC-UA/MQTT semantics, zero process injection.
Why this page exists
OT-native is a product pillar and not a synonym for Edge install docs.
Buyers comparing endpoint stacks need a clear answer: CyberDragon parses industrial protocols at the wire, without agents on controllers. This page is that answer.
Protocols
Modbus · DNP3 · OPC-UA · MQTT
Wire visibility
Protocol deep inspector
- Industrial protocol semantics at the collector.
- See writes before they become a plant-floor surprise.
- Same inspector the SOC uses in the kill-chain timeline.
Zones
Purdue topology the SOC can trust
- L0 process through L5 enterprise on one map.
- Edge placement is explicit at L3.
- Policy follows the corridor and not a flat network blob.
FAQ
Frequently asked questions.
Validate OT-native capture on your SPAN.
A dedicated CyberDragon tenant on your own traffic and not a slide deck. See kill-chain cyber defense on your network.