Documentation menu
Overview
Getting started
Platform
Partners
Security
Docs / Platform
OT visibility
kymeer recognises 11 industrial protocol families in the events you already send and shows them in eight OT dashboards, from IEC 62443 to NERC CIP.
kymeer recognises 11 industrial protocol families in events your sources already send, and presents them in eight OT compliance dashboards, including IEC 62443 zones and NERC CIP evidence.
Which protocols are recognised?
kymeer reads the protocol label in an event. If there is none, it falls back to the protocol's well-known port.
| Protocol | Port fallback |
|---|---|
| Modbus | 502 |
| DNP3 | 20000 |
| S7comm | 102 |
| OPC UA | 4840 |
| IEC 60870-5-104 | 2404 |
| IEC 61850 (including GOOSE and MMS) | label only |
| EtherNet/IP (CIP) | 44818 |
| PROFINET | label only |
| BACnet | 47808 |
| FINS | 9600 |
| SLMP (MELSEC) | label only |
Where an event carries a function code or operation, it is classed as a stop, a mode change, a write or other, so writes, mode changes and stop commands stand out.
Which OT dashboards are there?
| Dashboard | What it shows |
|---|---|
| OT asset inventory and coverage | Discovered or registered OT assets, and which of them are sending telemetry |
| IT/OT segmentation | Traffic across IEC 62443 zones and conduits that you define as network ranges |
| OT remote access | Remote access to OT (NERC CIP-005 R2, IEC 62443 SR 1.13 and 2.6) |
| Controller integrity | Changes to controllers (NERC CIP-010 R1, IEC 62443 SR 3.4 and 7.6) |
| Protocol allow-list | Protocol and behaviour that breaks your allow-list |
| NERC CIP evidence | NERC CIP evidence packs |
| Legacy exposure | Legacy and unpatchable assets |
| Safety-instrumented systems | Activity involving safety-instrumented systems |
What do the OT views show?
The dashboards show what your network sources record: protocol labels, ports and, where present, function codes.