Mirror traffic
Vardar
Connects to a passive SPAN or TAP port and starts decoding.
You provide
One mirror port on the OT switch, or a TAP on the segment to be observed.
1.0The boundary
Everything that decides anything
is inside the fence.
Decoding, correlation, model inference, investigation and storage all run on the appliance. The drawing below is the whole data flow.
Inside the site boundary
OT network
Mirrored traffic from a SPAN or TAP port. PLCs, HMIs, engineering stations, sensors.
Process data
Read-only historian or SCADA feeds, scoped by the customer.
Site context
Asset lists, zones, drawings and system events the site already keeps.
Vardar applianceInside the fence
- Protocol decoding
- Process relationships
- Learn, detect, explain
- Local storage
Findings out
Signed updates in
Local findings
Classified events with evidence trail, for OT and security teams on site.
Optional SOC, IT or SIEM integration
Findings and summaries only, under customer policy.
Outbound
Nothing raw. No packets, no process values, no site model.
Inbound
Signed detection and model updates, by approved media on air-gapped sites.
2.0Four steps
From mirror port
to guided response.
Map the environment
Vardar
Discovers assets, learns zones and the relationships between commands and process variables.
You provide
A read-only historian or SCADA account and, where available, an asset list or P&ID.
Detect the physics
Vardar
Checks network behaviour against process signals and classifies each finding as operational, cyber, mixed or unknown.
You provide
Nothing. The site model is learned from what the plant already does.
Guided response
Vardar
Explains each finding in plain English and recommends the next check.
You provide
The playbooks and approval gates that fit how the site already works.
3.0Air-gapped operation
The full product,
not the cut-down one.
Detection and the local analyst ship on the appliance. A site with no route to the internet runs everything, and receives detection and model updates as signed media.
No cloud dependency
Site operation does not depend on any external service.
Signed updates
Detection and model updates are verified on the appliance before they are applied.
Local storage
Evidence and findings are kept on the premises for the retention the customer sets.
4.0Integrations
Read-out by default.
Write-back by approval.
Vardar fits around the systems already in place. Integrations start as read-out of findings. Anything that acts on the plant is gated by customer policy and approval.
SIEM and SOC
Classified findings and evidence summaries, so the SOC sees the process context.
Ticketing and change management
Planned changes recognised; findings opened as cases with the evidence attached.
Existing network monitors
Vardar runs alongside, adding the physical-process evidence path.
Response integrations
Scoped and off by default. Enabled per integration, per site, by the customer.
5.0Data residency
What leaves the site:
nothing raw.
| Data | Where it goes |
|---|---|
| Raw OT traffic | Stays on site |
| Process values | Stay on site |
| Learned site model | Stays on site |
| Classified findings and evidence summaries | To the systems the customer connects, under customer policy |
| Anonymised detection patterns | Only if the customer opts in; never traffic, values, addresses or names |
6.0Regulatory evidence
Evidence your auditors
can follow.
On-site monitoring, classification and an evidence trail are what these frameworks ask operators to show. Vardar produces them inside the boundary.
NERC CIP-015EPA AWIATSA security directivesEU NIS2IEC 62443
One mirror port. One critical process.
An evaluation needs a SPAN or TAP port, a read-only process data account and the questions both teams ask about one process today.