Resources
For the engineers in the room.
The details that decide whether a sensor goes on your network.
- PDF
Technical brief
Architecture, edge/cloud split, detection layers and security controls.
- Guide
NIS2 for manufacturers
What NIS2 means for a 50–250 person plant, in plain language.
Coming soon
Protocol roadmap
We say what we decode and what we only observe as behaviour.
| Protocol | What Aragog reads | Phase |
|---|---|---|
| S7commS7-300/400 | CPU stop/start, block upload/download, write var, identity | MVP |
| Modbus/TCP | Writes from new sources, value ranges, device ID | MVP |
| RDP · VNC · SMBIT in OT | Remote-access path inventory | MVP |
| PROFINET DCP | Layer-2 discovery | v1 |
| S7comm-plusS7-1200/1500 | Session metadata, TLS detection, behavioural download detection | v1 |
| OPC UA | Endpoint and security-mode inventory | v1 |
| EtherNet/IP + CIP | Identity, CIP service classes | v1 |
| BACnet | I-Am inventory | v1 |
| MQTT · Sparkplug B | Sparkplug B decoding | v2 |
| ADS · SLMP · FINSBeckhoff, Mitsubishi, Omron | Native parsers | v2 |
| DNP3 · IEC 104Utilities | For utility-adjacent sites | v3 |
S7comm-plus on recent firmware is encrypted after session setup. We detect program downloads from behaviour and byte volumes, not by reading the content.
Put a sensor on one line. See what it finds.
A pilot is a real, passive deployment at one of your sites. Tell us a little about your plant and we will get back to you to scope it.
Passive only. Nothing on your process network changes.