Most engineers think…
Most people assume OT monitoring means either a loud active scan that risks tripping a PLC, or a basic NetFlow collector that only sees IP addresses. Neither is true of Nozomi Guardian.
Guardian is a passive deep-packet-inspection sensor: it reads a copy of the wire, decodes hundreds of industrial protocols down to register-level commands, and automatically builds a rich asset inventory and live network map — all without injecting a single packet. Its hybrid detection engine combines a learned behaviour baseline, a signature engine, and continuous threat-intelligence updates from Nozomi Labs, so it catches both known malware and novel zero-day anomalies. Understanding exactly what the sensor does — and what it doesn't — is what lets you place it correctly, justify it to OT operations teams, and answer the interview question confidently.
① What Nozomi Guardian is — the passive OT sensor
Guardian is Nozomi's core network sensor: it connects to a SPAN/mirror port or a TAP at an aggregation switch and listens to a copy of OT/ICS traffic. Because it only reads a copy, it is genuinely passive — it cannot cause a PLC fault, disrupt a control loop, or affect real-time operations. This is the non-negotiable starting point for OT security: any tool that injects traffic risks tripping fragile devices on the production floor.
Guardian deploys in three forms to fit any site. A physical appliance slots into a rack next to the aggregation switch and handles high-throughput industrial environments. A virtual machine (VM) runs on a site's existing hypervisor when dedicated hardware is not available. A container offers a lightweight deployment path for more modern or flexible environments. All three forms deliver the same DPI, discovery and detection capabilities.
Guardian Air is the wireless variant. Where wired sensors miss Wi-Fi-connected HMIs, Bluetooth sensors, handheld barcode scanners and cellular-attached field devices, Guardian Air captures that spectrum — Wi-Fi, Bluetooth, cellular and drone-band — and feeds the same asset inventory and detection pipeline as a wired Guardian.
Why is Guardian described as 'passive'?
② Inside Guardian — deep packet inspection & asset discovery
Guardian's DPI engine decodes hundreds of OT/ICS and IT protocols down to the field level: Modbus, DNP3, Profinet, EtherNet/IP (CIP), Siemens S7/S7+, OPC DA/UA, IEC 60870-5-104, IEC 61850 (MMS/GOOSE), BACnet and many more. This is far richer than an IP-layer NetFlow: Guardian can see that a specific master station issued a specific Modbus function-code 16 (write multiple registers) to a specific slave address — the kind of field-level context that matters for OT incident investigation.
Automatic asset inventory
Every device that appears in the traffic gets added to the asset inventory automatically. For each asset Guardian captures: IP address, MAC address, vendor, model, firmware version, operating system, open ports, protocols in use, and Purdue level. This passive inventory routinely surfaces rogue or unmanaged devices that the IT CMDB never knew existed. The result feeds an interactive network map: nodes are assets, edges represent observed communication paths. Operators can filter by Purdue level, zone or site; unexpected cross-zone edges stand out immediately. An optional Smart Polling add-on can send selective active queries (e.g. querying a PLC for its exact firmware build) to enrich the passive data where needed.
Guardian reads a copy of traffic from a SPAN or TAP, decodes OT/ICS protocols to field level, and never injects packets — zero risk to PLCs and RTUs.
An interactive graph of assets (nodes) and observed communications (edges), auto-built from passive DPI. Cross-zone edges stand out immediately.
The wireless sensor variant that captures Wi-Fi, Bluetooth, cellular and drone spectrum to cover wireless OT/IoT devices a wired SPAN cannot reach.
Periodic snapshots of full network and asset state that let you replay the network topology at any past point — essential for forensic root-cause analysis.
In interviews, the phrase to open with is 'Guardian uses passive DPI on a SPAN or TAP — it never injects packets.' That immediately shows you understand why OT teams accept it: no risk to PLCs. Follow up with the automatic asset inventory to show you know the value beyond just 'monitoring'.
Which capability lets Guardian discover firmware versions and Purdue levels without any scanning?
③ Hybrid detection & vulnerability assessment
Guardian's detection is hybrid — three complementary layers working together. The first layer is behaviour/anomaly-based: Guardian runs a self-learning phase to build a baseline of normal OT communications. After the baseline is established, deviations (a new connection between two devices that have never talked, a command type not seen before, an abnormal polling rate) raise anomaly alerts. This layer catches zero-day threats and operational anomalies that have no signature. The second layer is signature and rules-based: known attack patterns, malware indicators and policy violations are matched against a rules library. The third layer is threat intelligence from Nozomi Networks Labs: IOC subscriptions, YARA rules and packet-level rules are continuously updated and pushed to Guardian, ensuring it recognises the latest known threats without a manual update cycle.
Vulnerability assessment and Time Machine
Guardian cross-references each asset's discovered firmware and software version against CVE databases, producing a prioritised vulnerability list with risk scores. Because OT devices often cannot be patched quickly, Guardian highlights compensating controls alongside CVE findings. The Time Machine feature takes periodic snapshots of the full network and asset state — so after an incident you can replay 'what did the network look like at 02:45?' to reconstruct the attack path and support forensics.
Guardian is not a signature-only IDS. Its hybrid engine pairs a self-learned behaviour baseline (for zero-day anomalies) with a signature/rules engine (for known threats) and continuous Nozomi Labs threat intelligence. If you answer 'it uses signatures' in an interview, you've missed two-thirds of the detection model.
▶ Watch Guardian catch a rogue S7 command in real time
How a single suspicious Siemens S7 write is detected and raised as an alert. Press Play for the normal path, then Break it to see the classic blind spot.
A new command type appears between two devices that have never communicated before. Which Guardian detection layer raises this alert?
④ Deployment, placement & integration
Guardian sensor placement follows the Purdue model. The highest-value tap points are the Level 2 to Level 3 aggregation switches: a sensor here sees traffic between the field-device layer (Level 1/2) and the site-operations / historian layer (Level 3), capturing the richest mix of OT protocols. Additional sensors at Level 3 to Level 3.5 (the IT/OT DMZ) catch traffic crossing into the corporate network. Each sensor is scoped to the traffic volume and protocol mix at its tap point; physical appliances are chosen for high-throughput segments, VMs for lighter or remote sites.
Guardian data flows up to either Vantage (Nozomi's cloud-native SaaS platform) for multi-site aggregation, AI-driven analytics and a single pane of glass, or to the Central Management Console (CMC) for air-gapped or sovereignty-constrained estates. Guardian integrates with SIEM/SOAR platforms (Splunk, Microsoft Sentinel), ticketing systems (ServiceNow), and next-generation firewalls (Palo Alto, Fortinet) to feed OT alerts into the wider SOC workflow. Alert lifecycle: Guardian raises an alert with asset context, protocol detail and a severity score; the analyst confirms or suppresses it; confirmed alerts can auto-open a ticket or trigger a SOAR playbook.
Priya Nair, OT security engineer at PowerGrid South Pvt. Ltd., Chennai, faces this
Guardian raises an alert: 'New lateral communication path — engineering workstation initiating S7 reads to a protection relay it has never queried before.' The OT team says a technician may have been doing maintenance.
An unauthorised session (possibly lateral movement by malware on the workstation) is querying protection relay configuration registers outside any change window.
Open Guardian's network map, filter by the workstation IP — confirm an S7 session targeting the relay's config registers. Cross-reference the change-management system: no maintenance window is logged for that device pair.
Guardian Network Map ▸ filter by asset ▸ session detail ▸ Time Machine for session historyIsolate the workstation from the relay VLAN, initiate IR, use Guardian Time Machine to replay the session and extract forensic evidence. Scan the workstation for lateral-movement malware.
After isolation the alert clears; the network map shows no further unexpected edges from that workstation. Confirm via Time Machine that no further S7 writes occurred after isolation.
An asset that doesn't appear in Guardian's inventory may simply not be visible from your SPAN port — not necessarily absent from the network. Before concluding a device is 'not there', verify your SPAN is capturing all VLANs on the aggregation switch. A missed VLAN means a blind spot, not an empty segment.
An OT site is fully air-gapped and cannot use cloud services. Where does Guardian send its data for central management?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why can Guardian inventory OT assets without scanning them? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Guardian
- Nozomi's core passive OT/ICS network sensor — DPI, asset discovery, anomaly + threat detection and vulnerability assessment.
- Passive DPI
- Deep packet inspection performed on a traffic copy from a SPAN port or TAP, with no packets injected into the OT network.
- Guardian Air
- Nozomi's wireless sensor variant that captures Wi-Fi, Bluetooth, cellular and drone spectrum for wireless OT/IoT device coverage.
- Smart Polling
- An optional Guardian add-on that sends selective active queries to specific devices to enrich passive asset data where needed.
- Hybrid detection
- Nozomi's three-layer detection model: behaviour/anomaly baseline, signature/rules engine, and Nozomi Labs threat intelligence — working together.
- Time Machine
- Guardian snapshots of full network and asset state at regular intervals, enabling forensic replay of topology at any past point.
- Vantage
- Nozomi's cloud-native SaaS management platform that aggregates Guardian sensors across many sites into a single pane of glass.
- CMC (Central Management Console)
- Nozomi's on-premises virtual aggregation platform for air-gapped or sovereignty-constrained multi-site estates — the on-prem alternative to Vantage.
📚 Sources
- Nozomi Networks — Guardian: OT & IoT Network Security Sensor. nozominetworks.com/products/guardian
- Nozomi Networks — Guardian Air: Wireless OT/IoT Security Sensor. nozominetworks.com/products/guardian-air
- Nozomi Networks — Nozomi Networks Platform Overview (Guardian, Vantage, CMC, Arc). nozominetworks.com
- Nozomi Networks Labs — Threat Intelligence & Asset Intelligence subscription feeds. nozominetworks.com/labs
- CISA — Recommended Practices for Securing ICS: passive network monitoring guidance. cisa.gov/ics
- Nozomi Networks — Deployment Guide: Guardian sensor placement across the Purdue model. nozominetworks.com/resources
What's next?
Got Guardian? Next, explore Nozomi Vantage — the cloud-native SaaS platform that aggregates many Guardian sensors into one single pane of glass with Vantage IQ AI analytics.