Control gateways
Review observed scanner sources at the firewall in front of a reachable control gateway, alongside the access rules already approved for that site.
Industry blocklist
Operational Technology and ICS blocklist
Keep exposed control and monitoring gateways in view without asking plant teams to change the systems behind them.
The coverage
What our sensors observed
Our sensors saw probes against industrial controllers, plant monitoring services, building automation, and control gateways. The mapping brings these control and monitoring surfaces together in one feed.
Why use this feed
If a control gateway is exposed, apply the feed in your perimeter rules to review or block sources seen testing similar services. This gives your team a current source list while access to the gateway stays tightly scoped.
In your network
Where this feed fits
Use the observed source list where your existing edge controls meet these reachable services.
Building automation
Apply the same source list at the edge of externally reachable building controls instead of maintaining a separate manual block list for each location.
Remote maintenance
Use the feed as a signal when reviewing access to maintenance interfaces that must remain reachable for authorized operators.
Getting started
Put the feed to work
Choose your industry coverage, connect the feed to your existing firewall, and review exceptions with the people who run each service.
Choose coverage
Select this industry in a blocklist plan. Your selected industries and included threat categories are delivered in one continuously updated feed.
Connect your edge
Pull the feed in a supported format or use a firewall preset. Optional network aggregation can help where rule capacity is limited.
Review access
Check exceptions and existing allowlists before applying a deny rule to any service that needs outside connections.
Scope of the data
What this feed measures
This feed follows probes against control and monitoring services. It does not identify a plant, a facility, or the purpose of a connection.
Our sensors record connections to mapped services. The resulting source list helps you review or block observed scanners; it does not reveal what those scanners intended to do.
Industry blocklists
Start blocking observed scanner sources.
Test a scanner sample in your existing security tools, then choose the coverage that fits your network.
Your next step
Choose this industry in a blocklist plan. The feed stays current as our sensors observe new scanner sources.