Your team does not need another alert. It needs a defensible decision. Vardar reads a copy of the OT traffic and the process values, learns how this site behaves, and only calls something cyber when the network action and the physical consequence agree.
Each input answers a different question. None of them is enough on its own. Vardar correlates all four on the premises.
What was commanded, by whom, from where?
Protocol decoding of mirrored OT traffic: writes, downloads, mode changes, new talkers, sequences outside the learned pattern.
Native, from a SPAN or TAP port. Or alongside an existing network monitor.
What did the plant actually do?
Pressure, flow, level, temperature, speed and state, read from approved historian or SCADA feeds, compared with what the command should have produced.
Read-only historian or SCADA access, scoped by the customer.
Does this relationship make sense for this site?
Asset roles, zones, P&ID relationships and operating modes, so a valve command is judged against the pump and sensor it is supposed to move.
Asset lists, drawings and zone definitions the site already keeps.
What do the other tools already know?
Identity, maintenance windows, change tickets and alerts from systems already in place, so a planned change is not reported as an attack.
Read-out integrations under customer policy. Nothing is written back unless approved.
Vardar does not ship a universal picture of how plants behave. It learns this plant: which stations write to which controllers, how each process variable responds to each command, and what a normal shift looks like. The model is built and kept on the appliance.
Baselines come from observed traffic and process data, not from hand-written rules.
The model never leaves the site. Air-gapped sites run the full product.
Every finding names the relationship it is based on, in terms an engineer can check on the floor.
Every finding lands in one of four states. Unknown is a legitimate answer with an explicit next check, not a gap in coverage.
Equipment, process or instrumentation evidence explains the event.
Discharge pressure on Pump P-101 drifts low over three shifts. No network write touched the pump controller. The pattern matches impeller wear seen in the historian two years ago.
Route to maintenance with the trend attached.
Network behaviour and physical consequence support manipulation.
An engineering station writes a new setpoint to PLC-07 outside the learned sequence. The valve command changed but pressure and flow did not respond consistently.
Verify operator identity and physical valve state before escalation.
A cyber event and an operational condition are interacting.
A scheduled firmware update coincides with a pressure excursion. The update is in the change ticket; the excursion is not explained by it.
Hold the change window open and check the sensor before closing the ticket.
Evidence is incomplete; the next check is explicit.
Both evidence paths show abnormal behaviour, but the source of the write cannot be attributed to an operator yet.
Collect the missing evidence named in the finding. Do not confirm cyber until it is in.
The local AI analyst explains detector findings, traces approved site evidence and recommends the next check. It runs on the appliance, including in air-gapped environments.
Is Alert 142 operational or cyber?
Both evidence paths confirm abnormal behaviour. Cyber is suspected, but operator identity is still missing. Verify the write source and physical valve state before escalation.
Response ships closed. Vardar observes and recommends by default. Anything that changes state in the plant is gated by a human or a customer-defined workflow, and scoped to the integrations the customer enables.
Evidence and explanation. Always on.
Customer-defined playbooks propose the next check.
A human or a workflow gate confirms before anything fires.
Scoped integrations, only when enabled, only inside the approved boundary.
A technical evaluation starts with one critical process, the questions both teams ask about it today, and success criteria agreed in advance.