OT Network Visibility for Complex Industrial Environments.
Garland EdgeLens Solution
Garland’s EdgeLens series is an advanced bypass TAP with built-in packet broker functionality that centralizes network traffic, making network tools more efficient by sharing network traffic with monitoring and security tools. EdgeLens provides visibility for a hybrid configuration of an active, inline network device and out-of-band tools, such as LiveAction. EdgeLens provides identical network traffic streams through the active inline device and to the capture engine of LiveAction LiveWire or LiveCapture. The benefits of both devices seeing the same traffic are:
• Correlated data for real-time monitoring and root cause analysis using network packets.
• Historical look back and playback of the network traffic.
• Validating and updating network policy changes and spotting anomalies.
• Network data recording for compliance and security forensics.
• Root cause analysis for application and network related problems.
TAP -> TOOL
Scenario 1: Network TAP
When a customer does not have access to layer 3 switching or does not want to configure a SPAN or Mirror port to deploy Darktrace/OT, a Network TAP can be utilized. In a simple deployment architecture, a Garland Technology Network TAP will pass all network traffic from the tapped network link to the Darktrace appliance. With the hardware data diode design of the Garland Network TAP, this solution guarantees unidirectional traffic flow.
Scenario 2: SPAN Aggregation
When a customer wishes to use a configured SPAN/Mirror port on the Switch as the access method for Darktrace and is looking to capture mirrored traffic from multiple SPAN links, a Garland Aggregator TAP can be used to deploy the Darktrace appliance. With the hardware data diode design of the Garland Network TAP, this solution guarantees unidirectional traffic flow, while aggregating up to 8 SPAN/Mirror ports to 1 or 2 Darktrace appliances.
- Darktrace/OT + Garland Technology
- Full PDF Solution Brief
With its unified view of IT and OT environments, Darktrace is uniquely positioned to deal with relevant threats to IT/OT and the challenges posed by convergence and segmentation.
Darktrace/OT detects and responds to attacks in their earliest stages before costly damage is done. Darktrace/OT uses raw network traffic from an OT network to understand the normal pattern of life for every device and operator in the industrial environment. If a human or machine displays even the most nuanced forms of threatening behavior, the solution can identify this in real time based on statistical anomaly score.
Darktrace/OT does not need any data or threat feeds from external sources because the AI driven software builds an innate understanding of self without any need for third-party support or data. All data processing and analytics are performed locally on the Darktrace appliance. With no connection to the Internet required, Darktrace/OT functions within air-gapped or highly segmented networks without jeopardizing their integrity.
Garland Technology’s Network TAP and Packet Broker solutions enable the seamless deployment of Darktrace appliances in any OT environment. With the built-it data diode technology of many of the Garland TAPs and Aggregators, organizations are able to guarantee complete network visibility and have confidence that network traffic is unidirectional.
- How It Works
- Bypass TAP Benefits
- Full PDF Solution Brief
- How It Works
- How It Works
- How It Works
Bypass manages the availability of inline tools, preventing a single point of failure in the network by “bypassing” the device in the event it fails or needs to be updated. Reducing network downtime. Bypass is unique to the other TAP modes, as it is an inline use case not out-of-band.
