Most engineers think…
Most people assume OT security tools rely on either anomaly detection or signature matching — they expect to pick one and live with its blind spots.
Nozomi Guardian runs all three layers simultaneously: a self-learned behaviour baseline catches zero-day deviations specific to your plant network; signature and rules-based detection fires immediately on known ICS attack patterns; and Nozomi Networks Labs threat intelligence pushes fresh IOCs, YARA rules and adversary TTPs to every sensor automatically. The hybrid approach is why Guardian can detect a novel lateral-movement anomaly and recognise a known Modbus exploit in the same traffic stream — without waiting for a human to write a new rule.
① Why OT detection must be hybrid — zero-days meet known ICS threats
OT and ICS networks face two distinct threat classes at once. Novel/zero-day threats — a compromised engineering workstation polling RTUs from a new IP, stealthy lateral movement inside a Level-2 zone — leave no known signature, so only anomaly-based detection can catch them. But known ICS malware families (exploit-specific packet sequences, documented adversary TTPs) are best caught by fast signature matching — no baselining delay, immediate verdict on definitively malicious patterns.
A signatures-only approach leaves you blind to novel anomalies. An anomaly-only approach causes excessive false positives in OT environments where process changes look like attacks. The solution is hybrid detection: behaviour baselining + signatures/rules + live threat-intelligence enrichment. Nozomi Guardian runs all three simultaneously, so each layer covers the others' blind spots.
Why is hybrid detection necessary in OT/ICS environments?
② The learning phase — how Guardian builds your OT baseline
When Guardian is first deployed, it enters a learning/baselining mode. The passive DPI engine silently observes all traffic on the monitored network segments and builds a site-specific network behaviour model: which devices communicate with which, on which OT protocols (Modbus, DNP3, EtherNet/IP and others), at what frequency, and with what command parameter ranges for process operations.
When anomaly alerts go live
Signature-based alerts fire throughout — learning mode does not delay them. Anomaly alerts become active once the learning phase completes. The duration is configurable; a period long enough to capture representative process cycles (production runs, shift changes, maintenance windows) produces the most accurate baseline. If major topology changes occur later — new equipment, network reconfiguration — operators can re-trigger learning for affected segments to keep the baseline accurate and avoid false-positive noise.
Guardian combines behaviour/anomaly baselining, signature/rules-based detection, and Nozomi Labs threat intelligence — so zero-day anomalies and known ICS threats are both caught.
The initial passive observation period when Guardian builds the site-specific behaviour baseline. Signature alerts fire throughout; anomaly alerts go live only after the baseline is ready.
Nozomi Networks Labs subscription feed pushing IOCs, YARA rules, packet signatures, and adversary TTPs to Guardian sensors automatically — no manual rule authoring needed.
Guardian's forensic snapshot capability — periodic captures of full network and asset state, enabling pre/post-incident comparison, forensic timeline reconstruction, and safe recovery planning.
In an interview, be clear: signature and rules-based detection fires from day one — it does not wait for the learning phase. The learning phase only gates anomaly detection. A Guardian sensor deployed in a live OT network will already alert on known ICS attack patterns while it is still building its behaviour model.
During the learning phase, when do signature-based alerts fire?
③ Signatures, rules and Nozomi Labs threat-intelligence feeds
The second and third detection layers run alongside the behaviour baseline. Signature and rules-based detection matches known ICS attack patterns, malicious command sequences, and protocol-misuse patterns immediately — no learning period required. These rules cover documented exploits, function-code abuse on process protocols, and adversary TTP patterns mapped to MITRE ATT&CK for ICS.
Nozomi Networks Labs produces two subscription feeds that enrich both layers. The Threat Intelligence feed pushes fresh IOCs, YARA rules, packet-level signatures, and adversary threat behaviours to Guardian sensors automatically — keeping detection current without manual rule authoring. The Asset Intelligence feed delivers curated asset profiles and expected-behaviour models for specific device makes and models, which improves asset classification accuracy and cuts false positives by giving Guardian a richer picture of what normal looks like for a particular PLC or RTU model, not just the site average.
Nozomi Threat Intelligence is not a simple IP blocklist pushed to a firewall. It delivers YARA rules, packet-level signatures, and adversary TTP behaviour models that enrich Guardian's detection engine. Asset Intelligence is a separate feed improving classification accuracy, not generating security alerts. Keep the two feeds distinct in interviews.
▶ Watch a zero-day anomaly get caught mid-shift
How Guardian detects an unexpected Modbus write command from a new source. Press Play for the detection path, then Break it to see the classic baselining failure.
Nozomi Networks Labs Asset Intelligence feed primarily helps Guardian by…
④ Alert lifecycle — from detection to Time Machine forensics
Every detection event — whether from the anomaly layer or the signature layer — produces an alert in Guardian (and aggregated in Vantage or CMC) with full metadata: timestamp, source and destination, protocol, detection type, risk score, and MITRE ATT&CK for ICS mapping where applicable. Operators triage from the alert queue: is this alert correlated with a known maintenance window? Does it map to a real CVE on the involved device? They then acknowledge, escalate (via SIEM/SOAR connectors to Splunk, Microsoft Sentinel, ServiceNow, etc.) or dismiss, with a full audit trail.
Time Machine — rewind to before the incident
Time Machine takes periodic snapshots of the network and asset state. When an incident is confirmed, analysts rewind to the snapshot before it began — comparing topology, communication pairs, and device states to understand exactly what changed and when. In OT environments where many devices have no local logs, Time Machine snapshots are often the primary forensic artefact, enabling safe recovery planning by confirming the last known-good state of each affected segment.
Priya Nair at Bharat Power Grid Ltd. in Nagpur faces this
Multiple low-severity anomaly alerts fire the Monday after a weekend maintenance window — unexpected Modbus write commands from an engineering workstation to three RTUs.
The maintenance team re-cabled two workstations and IP assignments changed. Guardian's baseline expected those Modbus writes from the original IPs, so the new-IP writes look anomalous.
In the Vantage/Guardian alert queue, filter by anomaly type and source IP. Use Time Machine to pull the snapshot from before the maintenance window — it confirms the original communication pattern and shows the IP change.
Vantage ▸ Alerts ▸ Anomaly filter + Time Machine ▸ Pre-maintenance snapshotVerify with the OT team that the IP reassignment was authorised; create a whitelist/exclusion for the new IP-to-RTU communication pair; re-baseline the affected segment if further changes are planned.
No further anomaly alerts for that communication pair; Asset Intelligence confirms the workstation model and expected behaviour; Time Machine captures the new baseline in the next snapshot.
Before declaring an OT incident resolved, use Time Machine to compare the pre-incident and post-remediation network snapshots side-by-side. If any communication pairs, device states or asset attributes differ unexpectedly, the environment may not be fully restored. The snapshot comparison is the fastest way to confirm clean recovery without re-running full process tests.
Why is Time Machine especially valuable in OT incident response?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why does Nozomi Guardian need a learning phase before anomaly alerts are useful? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Hybrid detection
- Nozomi Guardian's three-layer approach: behaviour/anomaly baselining, signature/rules-based detection, and threat-intelligence enrichment — catching both zero-day and known ICS threats.
- Learning phase
- Guardian's initial passive observation period that builds the site-specific network behaviour baseline before anomaly alerts go live.
- Behaviour baseline
- Guardian's statistical model of normal OT communications — which devices talk to which, on which protocols, at what frequency — used to flag deviations as anomalies.
- Threat Intelligence (Nozomi Labs)
- Subscription feed pushing IOCs, YARA rules, packet-level signatures, and adversary TTP behaviour models to Guardian sensors automatically.
- Asset Intelligence (Nozomi Labs)
- Subscription feed delivering curated device profiles and expected-behaviour models for specific OT asset makes and models, improving classification accuracy and reducing false positives.
- Time Machine
- Guardian's forensic snapshot capability — periodic captures of full network topology, sessions, and asset state for pre/post-incident comparison and recovery planning.
- IOC
- Indicator of Compromise — a file hash, IP address, domain, or packet pattern associated with known malicious activity, used in signature/rules detection.
- MITRE ATT&CK for ICS
- MITRE's framework cataloguing adversary tactics, techniques, and procedures specifically targeting industrial control systems — mapped to Guardian alerts for context.
- False positive
- An alert raised on legitimate OT activity — often caused by an incomplete learning phase or unwhitelisted planned changes like IP reassignments.
- Alert triage
- The operator process of reviewing a Guardian alert with context (maintenance schedules, CVEs, topology changes) before acknowledging, escalating, or dismissing it.
📚 Sources
- Nozomi Networks — Guardian sensor: passive OT monitoring, anomaly detection & threat detection. nozominetworks.com/products/guardian
- Nozomi Networks — Vantage SaaS platform: multi-site OT/IoT security management. nozominetworks.com/products/vantage
- Nozomi Networks Labs — Threat Intelligence & Asset Intelligence subscription feeds. nozominetworks.com/labs
- MITRE — ATT&CK for ICS: adversary tactics & techniques for industrial control systems. attack.mitre.org/matrices/ics
- CISA ICS-CERT — ICS-CERT advisories and OT threat detection guidance. cisa.gov/ics-cert
- Nozomi Networks — OT/IoT security platform overview & hybrid detection methodology. nozominetworks.com
What's next?
Understand detection? Next, explore how Nozomi matches discovered OT assets to CVEs, scores risk under real OT patching constraints, and prioritises remediation — the vulnerability management and risk assessment workflow.