Passive capture
Edge collector at the DMZ
- Receive-only SPAN/TAP. We never inject into the process network.
- Parser health for Modbus, DNP3, and OPC-UA.
- OT-native is a product pillar — not a SIEM adapter.
Pillar 01 · OT-Native
Protocol-native capture without touching the PLC.
A dedicated deep dive for OT-native collection — separate from the Edge hardware story and from Core SIEM/SOAR. SPAN/TAP at L3, Modbus/DNP3/OPC-UA/MQTT semantics, zero process injection.
Why this page exists
OT-native is a product pillar — not a synonym for Edge install docs.
Buyers comparing endpoint stacks need a clear answer: CyberDragon parses industrial protocols at the wire, without agents on controllers. This page is that answer.
Protocols
Modbus · DNP3 · OPC-UA · MQTT
Wire visibility
Protocol deep inspector
- Industrial protocol semantics at the collector.
- See writes before they become a plant-floor surprise.
- Same inspector the SOC uses in the kill-chain timeline.
Zones
Purdue topology the SOC can trust
- L0 process through L5 enterprise on one map.
- Edge placement is explicit at L3.
- Policy follows the corridor — not a flat network blob.
FAQ
Frequently asked questions.
Is this the same as the Edge page?
No. Edge covers collector deploy, buffer, and transport. This pillar page covers the OT-native product thesis and protocol stance.
Do we install anything on PLCs?
No. Passive SPAN/TAP only.
Validate OT-native capture on your SPAN.
A dedicated CyberDragon tenant on your own traffic — not a slide deck. See kill-chain cyber defense on your network.